feat(allowlist): add Protocol Buffers (.proto) support

[chethanuk]

Summary

Adds Protocol Buffers as the first language-group contribution for tracking issue #470.

.proto files were skipped by both review paths because they were missing from the extension allowlist. This PR:

1. Allows .proto / .PROTO via supported_file_types.json
2. Maps **/*.proto → a dedicated protobuf.md rule doc (wire compatibility focus)
3. Adds table-driven tests for allowlist + rule resolution

No Go source changes. No exclude patterns (proto has no standard test-file convention per #470).

Why this was needed

diff / scan path
  → user include/exclude
  → allowedext.IsAllowedExt(ext)   ← .proto returned false → ExcludeExtension
  → allowedext.IsExcludedPath
  → SystemRule.Resolve             ← unmapped ext fell back to default.md

After this PR:

.foo.proto
  → IsAllowedExt(".proto") = true
  → Resolve("**/*.proto") → rule_docs/protobuf.md  (Wire Compatibility)

Changes

File	Change
internal/config/allowlist/supported_file_types.json	append .proto
internal/config/allowlist/allowed_ext_test.go	IsAllowedExt cases for .proto / .PROTO
internal/config/rules/system_rules.json	"**/*.proto": "protobuf.md"
internal/config/rules/rule_docs/protobuf.md	new — wire compat, enums, RPC, security
internal/config/rules/system_rules_test.go	Resolve cases for .proto paths

Rule doc focus

• Field numbers / wire + JSON compatibility
• Message/field design (optional, map/repeated, oneof)
• Enum zero sentinels
• RPC/streaming design
• Any / unbounded payloads / secrets in defaults

Test plan

• go test -run 'TestIsAllowedExt|TestResolve_DefaultRules' ./internal/config/allowlist/ ./internal/config/rules/
• go test ./internal/config/...
• make check
• make test
• grep -l "Wire Compatibility" rule_docs/* → only protobuf.md

Out of scope

• Other feat(allowlist): expand supported file types — language experts wanted #470 language groups (Zig, GraphQL, Solidity, .v ambiguity, …)
• Exclude-pattern additions for proto
• Terraform/HCL rule doc for already-supported .tf

Part of #470.

[github-actions]

✅ OpenCodeReview: No comments generated. Looks good to me.

[lizhengfeng101]

Review

The proto support itself looks good — clean changes, well-structured rule doc, and solid test coverage. Happy to see this land as part of #470.

However, this PR includes two unrelated CI changes that should be removed:

1. .github/workflows/release.yml — permissions downgrade (blocking)

permissions:
-  contents: write
+  contents: read

This will break the release workflow. Creating GitHub Releases and uploading artifacts on tag push requires contents: write. Please revert this change.

2. .github/workflows/ci.yml — govulncheck version pin (out of scope)

-  go install golang.org/x/vuln/cmd/govulncheck@latest
+  go install golang.org/x/vuln/cmd/govulncheck@v1.6.0

Pinning is good practice, but it's unrelated to proto support. Please submit this separately if desired.

Verdict

Remove the two CI file changes and the proto part is ready to merge.

[lizhengfeng101]

merge conflicts

[lizhengfeng101]

merge conflicts

[lizhengfeng101]

LGTM