feat(restriction_policies): opt-in prefetched bodies via --restriction-policies-bulk-source

[riyazsh]

Summary

Adds an opt-in --restriction-policies-bulk-source <path> flag to import. When set, the restriction_policies model reads prefetched per-ID GET response bodies from a JSON file on disk and skips the per-ID GET /api/v2/restriction_policy/<id> pass. Default unset preserves existing behavior.

Intended for callers that have already fetched policies in bulk and want to skip the per-ID GET fan-out.

File shape

JSON array of unwrapped per-ID GET response bodies. Each entry must have:

• id: non-empty string of the form <type>:<resource-id>, with type in {dashboard, notebook, slo} (the set enumerated by the legacy path and remapped by connect_id)
• type: "restriction_policy"
• attributes.bindings: array (may be empty — SkipResource is applied identically to the live per-ID GET path)

Entries are validated at load time; producer-bug shapes (wrong type, malformed id, duplicate id, etc.) are rejected with an actionable error before any HTTP calls fire.

Filter behavior note

When --restriction-policies-bulk-source is set, restriction_policies filters are evaluated against the prefetched full bodies. This can differ from legacy discovery for filters on attributes.* because the legacy LIST-derived stubs only contain id.

Test plan

• Unit tests added for: bulk-source enumeration short-circuit, prefetched-body import short-circuit, empty-bindings SkipResource parity with live path, all validator shape checks (missing file, non-list, non-dict entry, malformed id, unsupported id prefix, wrong type, missing/non-list bindings, duplicate id), discriminator fall-through when attributes is present without bindings.
• Full unit suite green (698 passing).
• Default-unset path covered (existing behavior unchanged).