Add MongoDB wire protocol connector

[haasonsaas]

Context

Gate supports PostgreSQL, MySQL, HTTP, and SSH. MongoDB is the most impactful missing protocol — PostgreSQL + MySQL + MongoDB covers the vast majority of application databases at Series A-C companies. Formal.ai supports MongoDB natively.

Proposal

Build a MongoDB wire protocol proxy connector:

• Parse MongoDB wire protocol (OP_MSG, OP_QUERY, OP_REPLY)
• Extract operation type, collection name, query filter, and projection from messages
• Expose to OPA policies: input.query.collection, input.query.operation (find, insert, update, delete, aggregate), input.query.filter
• Policy actions: allow, block, mask (redact fields in result documents)
• Support for MongoDB authentication (SCRAM-SHA-256)
• Connection pooling to upstream MongoDB
• Full audit logging of operations

Acceptance Criteria

• MongoDB OP_MSG protocol parsed and proxied
• Policy evaluation with collection/operation/filter context
• Data masking on result documents (field-level redaction)
• SCRAM-SHA-256 auth pass-through
• e2e tests with real MongoDB instance
• Example policies: block writes to production collections, mask PII fields