Enforce read-only policy parameter snapshots at build time

Summary

Policy execution shares spec.Parameters.Raw as an immutable snapshot published during policy-chain construction. Add zero-runtime-cost build-time safeguards so first-party policies cannot mutate the params argument passed to On* policy callbacks.

Rationale

PR #2617 intentionally removed the per-request JSON deep copy because it accounted for approximately 30% of ext_proc CPU time. The raw parameter map is now shared read-only across concurrent requests. Direct or nested mutation could otherwise leak state between requests and, in the direct-write case, cause concurrent map writes.

Affected areas

• gateway-builder/internal/validation/golang.go, extending ValidateGoInterface or its validation flow with an AST-based policy analyzer.
• SDK policy callback interfaces/documentation for the read-only parameter contract.
• Policy-engine executor concurrency coverage, including chain-level -race testing.

Required changes

1. Add build-time analysis for policy On* callback methods that rejects direct writes to the params argument, including:
   • indexed assignment such as params[key] = value;
   • delete(params, key);
   • clear(params).
2. Document that policy parameters are immutable snapshots and must be treated as read-only by all policy callbacks.
3. Add a concurrent chain-execution test suitable for go test -race that protects the shared-snapshot contract.
4. Document the analyzer's limitation for mutation through nested values or type assertions (for example, params["x"].(map[string]interface{})["y"] = value), and decide whether to add a shallow top-level copy as structural protection without restoring the JSON deep copy.

Acceptance criteria

• A policy containing any supported direct mutation pattern fails gateway-builder validation with an actionable diagnostic.
• Valid read-only parameter access continues to pass validation.
• SDK-facing documentation states the immutable/read-only contract.
• A chain-level concurrent execution test passes under the Go race detector.
• The solution does not restore per-request JSON marshal/unmarshal deep copies.

Backlinks

• PR: https://github.com/wso2/api-platform/pull/2617
• Review discussion: https://github.com/wso2/api-platform/pull/2617#discussion_r3567929865
• Requested by: @renuka-fernando