refactor(azure_policy): reduce AliasRegistry allocations via Rc sharing (#725)

Replace the compiler's two cloned BTreeMap fields (alias_map and
alias_modifiable) with a single Option<Rc<AliasRegistry>>. This
eliminates cloning two 73K-entry maps on every compilation by sharing
the registry through a reference-counted pointer.

Additional improvements:
- alias_map()/alias_modifiable_map() return &BTreeMap (zero-copy)
- Safe .get() indexing in ingest_alias_entries and build_object_from_keys
- Null-tolerant deserialization for AliasEntry.paths (~97% of real
  Azure catalog entries emit "paths": null)

All changes are within the azure_policy feature gate.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

examples/regorus/azure_policy.rs

@@ -23,8 +23,7 @@ use regorus::languages::azure_policy::aliases::AliasRegistry;
 use regorus::languages::azure_policy::compiler;
 use regorus::languages::azure_policy::parser;
 use regorus::rvm::RegoVM;
-use regorus::Source;
-use regorus::Value;
+use regorus::{Rc, Source, Value};
 
 /// Evaluate an Azure Policy definition against a resource.
 ///
@@ -60,11 +59,8 @@ pub fn azure_policy_eval(
     println!("Parsed policy definition from {policy_definition}");
 
     // 3. Compile to RVM bytecode.
-    let program = compiler::compile_policy_definition_with_aliases(
-        &defn,
-        registry.alias_map(),
-        registry.alias_modifiable_map(),
-    )?;
+    let registry = Rc::new(registry);
+    let program = compiler::compile_policy_definition_with_aliases(&defn, Rc::clone(&registry))?;
     println!("Compiled policy to RVM bytecode");
 
     // 4. Build normalized input.
@@ -138,7 +134,7 @@ pub fn azure_policy_aliases(aliases: String, resource_type: Option<String>) -> R
     if let Some(ref rt) = resource_type {
         let rt_lower = rt.to_lowercase();
         let mut found = false;
-        for (alias_name, _) in registry.alias_map() {
+        for alias_name in registry.alias_map().keys() {
             if alias_name.to_lowercase().starts_with(&rt_lower) {
                 println!("  {alias_name}");
                 found = true;
@@ -148,7 +144,7 @@ pub fn azure_policy_aliases(aliases: String, resource_type: Option<String>) -> R
             bail!("no aliases found for resource type '{rt}'");
         }
     } else {
-        for (alias_name, _) in registry.alias_map() {
+        for alias_name in registry.alias_map().keys() {
             println!("  {alias_name}");
         }
     }