feat(policy): add narrow attribute read API protos and generated code (#3634)

## Proposed Changes

Proto and generated-code portion of the narrow attribute read APIs,
split out so the heavy service implementation lands separately and
`protocol/go` releases cleanly.

Adds two RPCs to `AttributesService`:
- **`GetKeyMappingsByFqns`** — per value FQN: the attribute rule and
effective KAS keys (value > definition > namespace precedence), for
client-side key splits.
- **`GetEntitleableAttributesByFqns`** — per value FQN: rule, value id,
the definition's ordered value FQNs (hierarchy), and value-level subject
mappings, for server-side decisioning.

Includes the `.proto`, regenerated `protocol/go`, gRPC/OpenAPI docs, and
the generated `sdkconnect` client wrapper. The wrapper and the
`AttributesServiceClient` test mocks ship here because CI regenerates
them from the proto (`make connect-wrapper-generate`) and requires a
clean tree. Server methods are `Unimplemented` stubs.

## PR stack
Replaces the previous combined PR per review (separate proto/generated
from service logic). Merge order:
1. **this PR** — proto + generated + docs + sdkconnect wrapper
2. #3697 — service implementation (DB, SQL, real handlers, tests)

Follow-up feature branch: switch the SDK granter to consume
`GetKeyMappingsByFqns` and add an xtest proving key-split parity with
the previous SDK.

Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

Author: alkalescent