Implement builtins

- [x] `base64url.encode_no_pad`
- [x] `crypto.hmac.md5`
- [x] `crypto.hmac.sha1`
- [x] `crypto.hmac.sha256`
- [x] `crypto.hmac.sha512`
- [x] `crypto.md5`
- [x] `crypto.sha1`
- [x] `crypto.sha256`
- [ ] `crypto.x509.parse_and_verify_certificates`
- [ ] `crypto.x509.parse_certificate_request`
- [ ] `crypto.x509.parse_certificates`
- [ ] `crypto.x509.parse_rsa_private_key`
- [ ] `glob.quote_meta`
- [ ] `graph.reachable_paths`
- [ ] `graphql.is_valid`
- [ ] `graphql.parse`
- [ ] `graphql.parse_and_verify`
- [ ] `graphql.parse_query`
- [ ] `graphql.parse_schema`
- [x] `hex.decode`
- [x] `hex.encode`
- [ ] `http.send`
- [ ] `indexof_n`
- [ ] `io.jwt.decode`
- [ ] `io.jwt.decode_verify`
- [ ] `io.jwt.encode_sign`
- [ ] `io.jwt.encode_sign_raw`
- [ ] `io.jwt.verify_es256`
- [ ] `io.jwt.verify_es384`
- [ ] `io.jwt.verify_es512`
- [ ] `io.jwt.verify_hs256`
- [ ] `io.jwt.verify_hs384`
- [ ] `io.jwt.verify_hs512`
- [ ] `io.jwt.verify_ps256`
- [ ] `io.jwt.verify_ps384`
- [ ] `io.jwt.verify_ps512`
- [ ] `io.jwt.verify_rs256`
- [ ] `io.jwt.verify_rs384`
- [ ] `io.jwt.verify_rs512`
- [x] `json.patch`
- [ ] `net.cidr_contains_matches`
- [ ] `net.cidr_expand`
- [ ] `net.cidr_merge`
- [ ] `net.lookup_ip_addr`
- [ ] `object.union_n`
- [x] `opa.runtime`
- [x] `rand.intn`
- [ ] `regex.find_n`
- [ ] `regex.globs_match`
- [ ] `regex.split`
- [ ] `regex.template_match`
- [ ] `rego.parse_module`
- [x] `semver.compare`
- [x] `semver.is_valid`
- [x] `sprintf`
- [x] `time.add_date`
- [x] `time.clock`
- [x] `time.date`
- [ ] `time.diff`
- [x] `time.now_ns`
- [x] `time.parse_duration_ns`
- [ ] `time.parse_ns`
- [x] `time.parse_rfc3339_ns`
- [x] `time.weekday`
- [ ] `trace`
- [x] `units.parse`
- [x] `units.parse_bytes`
- [x] `urlquery.decode`
- [x] `urlquery.decode_object`
- [x] `urlquery.encode`
- [x] `urlquery.encode_object`
- [ ] `uuid.rfc4122`
- [ ] `yaml.is_valid`
- [ ] `yaml.marshal`
- [ ] `yaml.unmarshal`

The issue is a broad checklist of implemented and unimplemented builtins, with no files, tests, or single target identified. Start by locating the Rust builtin registration and test entry points, then select and scope one unchecked builtin with maintainer guidance. Done should include the selected builtin implementation and its verification.

Written by the indexing model from the issue text.