feat: allow underscore prefix for private identifiers

[ivanauth]

Summary

• Enable underscore prefix (_) for definition, relation, and permission identifiers
• Establishes a convention for marking identifiers as "private" or "internal"

Description

This PR implements the feature requested in issue #2066 by updating the identifier regex patterns from [a-z] to [a-z_] to allow identifiers to begin with an underscore.

This is useful for:

• Synthetic permissions: Permissions that exist only to compose other permissions
• Internal relations: Relations not meant to be directly referenced by application code
• Implementation details: Parts of your schema that may change without affecting the public API

Changes

• Updated regex patterns in proto validation to allow underscore-prefixed identifiers
• Updated corresponding test expectations

Example Usage

definition document {
    relation viewer: user
    relation _internal_viewer: user
    
    // Private synthetic permission
    permission _can_view = viewer + _internal_viewer
    
    // Public permission
    permission view = _can_view
}

Note

End-user documentation for this feature should be added to authzed/docs at pages/spicedb/concepts/schema.mdx.

Fixes #2066

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.30%. Comparing base (dbd2687) to head (ddd8b7b).
⚠️ Report is 4 commits behind head on main.

❌ Your project check has failed because the head coverage (74.30%) is below the target coverage (75.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2733      +/-   ##
==========================================
- Coverage   74.35%   74.30%   -0.04%     
==========================================
  Files         483      484       +1     
  Lines       56954    57307     +353     
==========================================
+ Hits        42341    42575     +234     
- Misses      11644    11741      +97     
- Partials     2969     2991      +22     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[miparnisari]

Why are we writing this doc here? This will not get published anywhere. Maybe we should update https://authzed.com/docs/spicedb/concepts/schema instead?

[ivanauth]

Thank you, i removed docs from this pr and created a new docs pr.

[josephschorr]

I think if we introduce this, we should enforce that private identifiers cannot be accessed outside the scope of either the definition or the file (in composable schemas) and perhaps even enforce that they cannot be used in API calls

[ivanauth]

@josephschorr good point - do you want me to try adding definition-scoped + API rejection by default?