[Protobuf][3/n] Wire an actor UUID validator into generated protobuf server code

[mark200]

Description

The previous PR#2519 in this stack makes protoc-gen-yarpc-go emit an ActorUUID() accessor on every message with a reachable actor_uuid-annotated field. This PR closes the loop on the server side: it lets services install a validator that runs against those UUIDs after the request is decoded but before the user's handler executes, mirroring what thriftrw-plugin-yarpc already provides for thrift services (encoding/thrift.ActorUUIDValidator).

New public API in encoding/protobuf (actor_uuid.go):
- ActorUUIDValidator — func(ctx, actorUUIDs []string) error, receiving exactly what the generated ActorUUID() accessor returns.
- RegisterOption / WithActorUUIDValidator(v) — server-side registration option that installs the validator.
- ValidateActorUUID(...) and ActorUUIDValidatorFromOptions(...) — helpers called by generated code, not by users. A rejection is wrapped in an PermissionDenied YARPC error

Generated code (template in lib.go, fixture in withuuid.pb.yarpc.go):
- Build<Service>YARPCProcedures gains a variadic ...protobuf.RegisterOption
parameter, the handler struct carries the validator, and every handler whose request type has annotated paths (unary, oneway, and streaming handlers that carry a request message) calls ValidateActorUUID(ctx, validator, request.ActorUUID(), service, method) before invoking the user's handler.
- The Fx constructors accept the validator as an optional:"true" dependency.

Changed files
- encoding/protobuf/actor_uuid.go — Public server-side API
- encoding/protobuf/protoc-gen-yarpc-go/internal/lib/lib.go — Template changes; conditionally add validator fields, RegisterOption params, and per-handler ValidateActorUUID calls only for annotated services/methods
- encoding/protobuf/protoc-gen-yarpc-go/internal/lib/uuid.go — Per file UUID analysis cache; serviceHasActorUUID/methodHasActorUUID gating helpers; memoized walk results
- encoding/protobuf/protoc-gen-yarpc-go/internal/tests/withuuid/withuuid.pb.yarpc.go — Regenerated fixture showing validator plumbing

Backwards compatibility

Installing no validator is always safe: a nil validator makes the generated check a no-op, so services that regenerate but never call WithActorUUIDValidator keep their existing behaviour. Whether an empty UUID slice is acceptable is the validator's decision, so handlers on partially annotated services can still be supported by treating empty as "not provided".

Stacked PRs

1. internal/protogen — shared descriptor-agnostic core PR#2535
2. gogo converter + ActorUUID() emission in protoc-gen-yarpc-go PR#2519
3. this PR — server-side validator wiring PR#2520

Test Plan

• Unit tests for the gating helpers (annotated vs. unannotated services and methods, cross-file request types, error propagation) and for the cache-backed variants.
• An end-to-end validator_test.go against the real generated withuuid fixture: validator receives the exact UUIDs the accessor collects, rejections surface as PermissionDenied errors naming the service and procedure and never reach the handler, nil validator and unannotated methods skip validation entirely.
• Golden-file runner tests asserting the generated output.

RELEASE NOTES:

Wire ActorUUID validator into protobuf generated code

The merge-base changed after approval.

[mthakoreuber]

I couldn't understand this explanation

[mark200]

Updated the comment

[mthakoreuber]

Sorry, I couldn't understand any of this :(

[mark200]

Updated the comment here as well