Build and run unit tests for OPA Rego policies using opa test with coverage

Steps

1. Organize policy files and test files in the same directory; name test rules with the `test_` prefix inside a package named `<policy_package>_test` (e.g., `package authz_test`).
2. Write test rules that assert expected `allow` or `deny` values by calling the policy rules with mock input objects: `test_deny_missing_label { deny[_] with input as {...} }`.
3. Run `opa test ./policies/ -v` to execute all test rules; `-v` prints each test name and pass/fail status.
4. Add `--coverage` to produce a line-level coverage report: `opa test ./policies/ --coverage | jq '.coverage'` shows the percentage and uncovered lines.
5. Integrate into CI by checking the exit code: `opa test` exits 0 on all pass, 1 on test failure, 2 on error; fail the pipeline on non-zero.
6. Use `opa test . --threshold 80` to enforce a minimum coverage percentage and fail the CI step if coverage falls below the threshold.