mod,lib: update cel-go to cel.dev/cel-go v0.32.0 (#131)

Update the import path from github.com/google/cel-go to cel.dev/cel-go
and fix two breaking changes.

NativeToValue now converts json.Number to Int or Double rather than
passing it through. Fix by replacing json.Number values with rawNumber,
a named string type, before the call in all UseNumber decode paths. CEL
sees rawNumber as a string via the reflect.String fallback;
json.Marshal emits it unquoted via MarshalJSON, preserving round-trip
fidelity at any nesting depth.

The internal evaluator now calls Exec() on interpretable nodes via the
new InterpretableV2 interface. Update the coverage decorator to use
CustomDecoratorV2 and add Exec() overrides to all wrapper types so
coverage is recorded from either evaluation path. Update the
unsupported-type guard to use InterpretableV2 as its method-count
baseline.

Also bump go version to go1.26.8 to address govulncheck issues.

lib: add streaming decode, stream producers, and emit macro

Add three composable features for processing large payloads in CEL
programs without materialising all records in memory:

- Opaque stream type (streamVal) wrapping io.Reader, with stream_gzip
  and stream_zip producers that wrap decompression readers around
  in-memory bytes.

- Lazy JSON stream decoder (decode_json_stream_lazy) that accepts
  stream, bytes, or string and returns a traits.Iterable decoding
  values on demand via json.Decoder.

- Emit macro that iterates a list or iterable, calling an Emitter
  callback for each element. Supports optional per-element cursor
  tracking. In the mito CLI, emitted events are printed to stderr.

mito,internal/fb: add -fb flag for filebeat-compatible config validation

When -fb is passed, mito validates the run configuration against the
same constraints the filebeat CEL input enforces: auth mutual
exclusion, per-method field requirements, resource URL, rate limit
and retry bounds, max_executions, and rejection of a "secret" key in
state. A secret_state config field is provided as the correct
alternative, injected into state.secret before execution.

Validation uses plain Go structs with yaml tags, not go-ucfg.
Behaviour under -fb is not covered by semver compatibility
guarantees since the validation rules track upstream filebeat.

lib,mod: handle map[any]any and []any from cel-go v0.27.0

cel-go v0.27.0 (google/cel-go#1261) changed ConvertToNative to
remap interface{} targets to map[any]any for maps and []any for
lists. This breaks type switches in makeMapStrings, makeStrings,
and mapStrings that expected the previous map[ref.Val]ref.Val and
[]ref.Val types.

Add cases for the new types, round-tripping through NativeToValue
and ConvertToNative with an explicit target type.

lib,mod: handle map[any]any and []any from cel-go v0.27.0

cel-go v0.27.0 (google/cel-go#1261) changed ConvertToNative to
remap interface{} targets to map[any]any for maps and []any for
lists. This breaks type switches in makeMapStrings, makeStrings,
and mapStrings that expected the previous map[ref.Val]ref.Val and
[]ref.Val types.

Add cases for the new types, round-tripping through NativeToValue
and ConvertToNative with an explicit target type.

lib,mod: handle map[any]any and []any from cel-go v0.27.0

cel-go v0.27.0 (google/cel-go#1261) changed ConvertToNative to
remap interface{} targets to map[any]any for maps and []any for
lists. This breaks type switches in makeMapStrings, makeStrings,
and mapStrings that expected the previous map[ref.Val]ref.Val and
[]ref.Val types.

Add cases for the new types, round-tripping through NativeToValue
and ConvertToNative with an explicit target type.

Retract v1.25.0 which shipped without this fix.

mod: update cel to v0.27.0

v0.27.0 is marked as a breaking release. The breaking change
(google/cel-go@c66b3130b) removes standard type names (int, string,
bool, etc.) from the environment's variable declarations. Before
this change, declaring a user variable with one of those names
caused an "overlapping identifier" error; now user variables can
shadow type names. Type resolution is unaffected because the
checker falls through to the type provider. We do not declare
any user variables with standard type names, so this has no
impact on mito.

[git-generate]
go get google.golang.org/genproto/googleapis/rpc@v0.0.0-20260319201613-d00831a3d3e7
go get github.com/google/cel-go@v0.27.0
go mod tidy

go run github.com/uber-go/gopatch@latest . << PATCH
@@
@@
- ast, iss = cel.NewStaticOptimizer(folder).Optimize(env, ast)
+ opt, err := cel.NewStaticOptimizer(folder)
+ if err != nil {
+     return nil, nil, nil, fmt.Errorf("failed to make new static optimizer: %v", err)
+ }
+ ast, iss = opt.Optimize(env, ast)

@@
@@
- return types.NewErr(err.Error())
+ return types.NewErr("%v", err)

@@
var x identifier
@@
- return types.ValOrErr(x, "no such overload for "+name)
+ return types.ValOrErr(x, "no such overload for %s", name)

PATCH

testdata: make example.com tests less brittle

testdata: make example.com tests less brittle

testdata: make example.com tests less brittle