feat: remove dependency on pgsodium

[soedirgo]

Add a new version 0.3.0 that doesn't depend on pgsodium. All the needed pgsodium functionalities are baked directly into supabase_vault.

Tested flows:

1. pause & restore w/o vault
   • create a new project
   • drop extension supabase_vault cascade;
   • pause project
   • restore project
   • select * from vault.decrypted_secrets
2. pause & restore w/ existing secrets
   • create a new project
   • create a new secret in Settings > Vault
   • pause project
   • restore project
   • select * from vault.decrypted_secrets
3. pause & restore w/ existing secrets w/o pgsodium
   • follow steps in 2
   • drop extension pgsodium
   • pause project
   • restore project
   • select * from vault.decrypted_secrets
4. pg_upgrade
   • create a new project on an earlier AMI version (e.g. 15.6.1.139)
   • create a new secret in Settings > Vault
   • upgrade project in Settings > Infrastructure
   • select * from vault.decrypted_secrets

[notion-workspace]

Remove Vault’s dependency on pgsodium

[soedirgo]

Creating a separate version here as an alternative to 0.2.8 -> 0.3.0. This lets the extension be created without first creating pgsodium, which would be necessary when creating 0.2.8.

[soedirgo]

Only 0.2.8 (the current latest version) requires pgsodium - future versions won't require it.

[olirice]

is this necessary if the dep is getting pulled out?

[soedirgo]

Yeah we use pgsodium code in pgsodium.c and pgsodium.h; we can do away with them once we move from libsodium (still needed to decrypt existing secrets)

[olirice]

these roles come from pg_sodium. for new installs on 0.3.0 is pg_sodium still required?

there is no exception in tests currently due to fixtures.sql creating these roles but wouldn't that need to be directly in this setup script for prod?

[soedirgo]

The roles will stay when pgsodium is dropped (Postgres doesn't track extension dependents for roles).

I'll see if I can change how the permissions is set up so we can further remove pgsodium-isms, but at worst we just create these roles at AMI creation once we stop creating pgsodium by default.

[samrose]

@soedirgo if it would help once I have a pg 17 in https://github.com/supabase/postgres I could set up a flake here that would let you isolate and use it, so that you could end up with 1:1 sync with what is built and used downstream.

[samrose]

This would help you match exact build + avoid having to maintain your own build of postgres in this project too.

[samrose]

...it could also then use the cached versions we have, and would save time on local machine and CI too.

[soedirgo]

Yeah that'd be fantastic 👍 it'd halve the size of this PR