feat: add authz provider capabilities and ABAC ReBAC contracts

[intel352]

Summary

• Adds provider capability descriptors so UIs can truthfully advertise RBAC, ABAC, and ReBAC support.
• Adds declared authorization catalog contracts for scopes, resources, actions, attributes, relations, and UI actions.
• Adds Permit/Keto-backed scope role provider integrations plus ABAC/ReBAC provider contracts and unified decision step.

Verification

• GOWORK=off go test ./...
• wfctl plugin validate-contract .

Notes

• Admin-merge requested by maintainer; not waiting on Copilot review.