Add idempotency_level check plugin

[fchimpan]

Summary

Adds a Buf check plugin that requires read-only RPCs (Get* / List* by default) to explicitly declare an idempotency_level such as NO_SIDE_EFFECTS, so that side-effect-free methods are marked as such (e.g. to enable HTTP GET support and caching in Connect).

Changes

• main.go: the METHOD_IDEMPOTENCY_LEVEL lint rule built on bufplugin-go. Prefix matching is case-insensitive and respects PascalCase word boundaries (Get matches GetUser but not GettyImages). Targeted prefixes are configurable via the method_prefixes option (string list or comma-separated string; setting it replaces the defaults).
• main_test.go / testdata/: table-driven tests — checktest-based integration tests asserting exact annotation locations and messages, plus unit tests for option parsing and prefix matching.
• .github/workflows/ci.yaml: gofmt / go vet / go test on pushes to main and on PRs.
• .github/workflows/release.yaml: on v* tags, a Wasm build is pushed to the BSR via buf plugin push, labeled with the tag.
• renovate.json: keeps SHA-pinned actions and Go modules up to date.
• README.md: consumer-facing content only — BSR usage, options, and motivation.

Notes

• Distribution is BSR-only (buf.build/fchimpan/idempotency-level); no prebuilt binaries.
• All GitHub Actions are pinned to commit SHAs of their latest releases (SHAs resolved and verified via the GitHub API).
• Buf's standard ignore mechanisms (// buf:lint:ignore METHOD_IDEMPOTENCY_LEVEL, lint.ignore_only, lint.ignore) apply to this rule as-is; verified against buf CLI v1.72.0.
• The BSR publish job requires the BUF_TOKEN repository secret (already configured).
• A method matching a configured prefix passes with any explicit level (NO_SIDE_EFFECTS or IDEMPOTENT); only the unset default (IDEMPOTENCY_UNKNOWN) is flagged.

Test coverage

go test ./... — integration tests compare rule ID, message, and exact source spans via checktest; unit tests cover option parsing edge cases (defaults, blank entries, comma-separated form, invalid types) and prefix word-boundary matching, including compound prefixes like BatchGet.