feat: add lint to detect RLS policies that allow access to anonymous users

[kangmingtay]

What kind of change does this PR introduce?

• adds a lint to check if there are any policies that allow access to anonymous users

What is the current behavior?

• currently, if a user enables anonymous sign-ins for their project, they need to manually check existing RLS policies to see if any of them are compromised.

What is the new behavior?

• this lint will highlight any policies that:
  • are associated to the authenticated, public, or any other role members
  • policies that don't contain the auth.jwt()->>'is_anonymous' expression in the policy definition

Additional context

Add any other context or screenshots.

[olirice]

Is there a way to check if a user has enabled anonymous logins from within the database? Currently this lint will fire on almost every project and only a small fraction are likely to enable anonymous logins in the short term.

[olirice]

Before we can merge this we need to get the FE integration updated to not run all lints by default.

Terry is back tomorrow and I'll discuss it with him then but this might get pushed out til the week after LW as everyone is starting to get crunched

[charislam]

Could you change this to a main docs site link please? Following the pattern here: https://supabase.com/docs/guides/database/database-advisors

[kangmingtay]

blocked on deciding how we can run lints conditionally on the platform - currently, there's no way to conditionally execute a lint from the splinter.sql file

[MostafaGoodsh]

Cool