feat: Ensure RVM caches deterministic builtins

Mirror interpreter implementation:
- use builtins::must_cache to determine whether builtin must be cached.
- reuse cached value when applicable
- clear the VM’s builtin cache whenever execution state resets to avoid leaking values across runs
- add a YAML regression for rand.intn set comprehensions and re-enable the rand cases in the OPA test suite

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

tests/opa.rs

@@ -36,7 +36,6 @@ const OPA_TODO_FOLDERS: &[&str] = &[
     "partialdocconstants",
     "partialobjectdoc",
     "planner-ir",
-    "rand",
     "refheads",
     "replacen",
     "semverisvalid",

tests/rvm/rego/cases/builtins_cache.yaml

@@ -0,0 +1,15 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+cases:
+  - note: builtin_rand_intn_cache_consistency
+    data: {}
+    modules:
+      - |
+        package test
+
+        rands := { rand.intn("seed", 100) | numbers.range(1, 100)[_] }
+
+        np := count(rands)
+    query: data.test.np
+    want_result: 1