server/csharp: Add basic masking support

[philipaconrad]

What changed?

This PR adds very basic masking support to the C# TicketHub server implementation, along with a policy that masks the tickets.description field with ***.

This is currently done in the slow way-- querying a specific masking rule in OPA directly via an extra HTTP call to /v1/data/tickets/filters/masks.

Masking Support

The only masking function supported at this time is replace, which allows substituting a value with a replacement. Best-effort type conversion occurs behind the scenes, but if it's a sufficient mismatch, runtime exceptions can and will be thrown. 😅

Here's the rule that masks all tickets.description fields:

masks["tickets.description"] := {"replace": {"value": "***"}}

The server is currently hard-coded to query /v1/data/tickets/filters/masks to get the JSON blob describing the column masking rules. These rules can be conditional on other data visible to the policy, but the above example is the "simplest thing that works". (This should be patched before merge.)

In the React UI, this looks like:

How to Test?

1. If you haven't rebuilt the C# server recently, run docker compose build server-csharp --parallel --no-cache
2. To launch the demo: docker compose --profile react --profile csharp up --force-recreate --renew-anon-volumes
3. To shut down the demo: docker compose --profile react --profile csharp down