v0.2.2

v0.2.2 — policies no longer get network access

engine.Evaluate compiled policies with OPA's default capabilities, which
include http.send, net.lookup_ip_addr and opa.runtime. Policies are
third-party code loaded at runtime, so a short rule could exfiltrate the
evaluated input or reach the runner's internal network from inside the
scanner. Those builtins are removed from the capability set.

No functionality lost: verified against both consumers' rule sets.
Behaviour change: a policy calling one of them now fails to compile.