Fix policy variable scoping issues, enable conformance tests around it

Port of cel-expr/cel-go#1321

PiperOrigin-RevId: 924956895

Author: l46kok

policy/src/main/java/dev/cel/policy/CelCompiledRule.java

@@ -48,21 +48,21 @@ public abstract class CelCompiledRule {
    * return an optional value if all match expressions under the rule are conditional.
    */
   public boolean hasOptionalOutput() {
-    boolean isOptionalOutput = false;
+    if (matches().isEmpty()) {
+      return false;
+    }
     for (CelCompiledMatch match : matches()) {
-      if (match.result().kind().equals(CelCompiledMatch.Result.Kind.RULE)
-          && match.result().rule().hasOptionalOutput()) {
-        return true;
+      boolean matchHasOptional = false;
+      if (match.result().kind().equals(CelCompiledMatch.Result.Kind.RULE)) {
+        matchHasOptional = match.result().rule().hasOptionalOutput();
       }
 
-      if (match.isConditionTriviallyTrue()) {
+      if (match.isConditionTriviallyTrue() && !matchHasOptional) {
         return false;
       }
-
-      isOptionalOutput = true;
     }
 
-    return isOptionalOutput;
+    return true;
   }
 
   /**

policy/src/main/java/dev/cel/policy/CelPolicyCompilerImpl.java

@@ -249,14 +249,18 @@ private CelCompiledRule compileRuleImpl(
   }
 
   private void checkUnreachableCode(CelCompiledRule compiledRule, CompilerContext compilerContext) {
-    boolean ruleHasOptional = compiledRule.hasOptionalOutput();
     ImmutableList<CelCompiledMatch> compiledMatches = compiledRule.matches();
     int matchCount = compiledMatches.size();
     for (int i = matchCount - 1; i >= 0; i--) {
       CelCompiledMatch compiledMatch = compiledMatches.get(i);
       boolean isTriviallyTrue = compiledMatch.isConditionTriviallyTrue();
 
-      if (isTriviallyTrue && !ruleHasOptional && i != matchCount - 1) {
+      boolean matchHasOptional = false;
+      if (compiledMatch.result().kind().equals(Kind.RULE)) {
+        matchHasOptional = compiledMatch.result().rule().hasOptionalOutput();
+      }
+
+      if (isTriviallyTrue && !matchHasOptional && i != matchCount - 1) {
         if (compiledMatch.result().kind().equals(Kind.OUTPUT)) {
           compilerContext.addIssue(
               compiledMatch.sourceId(),