feat(evaluator): implement graph builtins

[dangzitou]

Summary

• implement graph.reachable and graph.reachable_paths using the traversal semantics from OPA v1/topdown/reachable.go
• register both core builtins with capabilities metadata
• enable the official graph compliance fixtures, including Rego literals with set(), empty objects, and trailing commas
• add focused coverage for array/set edges, cycles, and missing nodes

Reproduction

On current main, the focused registry tests failed 2/2 on three consecutive runs because both graph builtin names were absent.

Verification

• ./gradlew :opa-evaluator:test --tests io.github.open_policy_agent.opa.ast.builtin.impls.GraphBuiltinsTest --tests io.github.open_policy_agent.opa.ast.builtin.CapabilitiesGeneratorTest
• ./gradlew :opa-evaluator:pmdMain :opa-evaluator:pmdTest :opa-evaluator:checkstyleMain :opa-evaluator:checkstyleTest
• ./gradlew build -x test
• Full ComplianceTest: every graph fixture passes. The only two remaining failures are time/format and json_match_schema/invalid document; both reproduce unchanged on upstream/main.

Fixes #132

[dangzitou]

Could a maintainer please rerun the failed PR Check workflow?

Both attempts failed in Check what files changed while open-policy-agent/setup-opa was downloading OPA (socket hang up / HTTP 503), before change detection or module tests ran. The other independent checks passed, and the branch is up to date with main.

Thanks!

[sspaink]

opa-builtins/README.md:106 still lists graph.* as unimplemented, so the table now contradicts this PR. #191 was a dedicated commit to fix this same table drifting, so probably worth folding into this change:

| `bits.*`, `units.*`, `http.send` | No |

...plus a Yes row for graph.reachable, graph.reachable_paths.

[sspaink]

buildPaths recurses once per path node, so deep graphs blow the JVM stack — measured on this branch, a 10k-node chain throws StackOverflowError (12k+ gives OutOfMemoryError), where OPA Go returns the 20,001-element path fine since goroutine stacks grow.

Evaluator.invokeBuiltin only catches TypeError/BuiltinError, so the Error escapes evaluate() entirely instead of surfacing as an OpaException — and the graph can come from data. Worth making this iterative with an explicit work stack, or at minimum bounding depth and throwing BuiltinError.