feat: cel supported operators

[wolf4ood]

What this PR changes/adds

Adds an optional supportedOperators field to CEL expressions. It limits which constraint operators an expression is invoked with.

• Empty (default): behavior is unchanged. The expression runs whenever its left operand matches.
• Non-empty: at runtime, an expression runs only when the constraint's operator is in the list. If no expression registered for a left operand supports the operator, the constraint is denied.
• Policy validation: creating or updating a policy definition fails if a constraint uses an operator that no CEL expression for its left operand supports.

Operators use the enum names, e.g. "EQ" or "IS_PART_OF". The deprecated IN is treated as IS_PART_OF.

CEL expressions can also use a new binding, this.odrlOperator. It holds the ODRL operator name without the namespace ("eq", "isPartOf", …), next to the existing this.operator, which holds the enum name. Expressions can use the same names policy authors write in ODRL, and IN/IS_PART_OF both show up as "isPartOf". Example:

this.odrlOperator == 'eq' ? ctx.x == this.rightOperand : ctx.x in this.rightOperand

Also:

• Adds the new field to the model, the management context, the v5 JSON schema, the transformers and the SQL store. The store adds a supported_operators column, with ADD COLUMN IF NOT EXISTS for existing tables.
• PolicyValidator now reports each validation failure only once. Before, a function registered in several policy contexts reported the same failure once per context.

Why it does that

Briefly state why the change was necessary.

Further notes

List other areas of code that have changed but are not necessarily linked to the main feature. This could be method
signature changes, package declarations, bugs that were encountered and were fixed inline, etc.

Who will sponsor this feature?

Please @-mention the committer that will sponsor your feature.

Linked Issue(s)

Closes #6023

Please be sure to take a look at the contributing guidelines and our etiquette for pull requests.