cel: patch thread safety issue

bazel/cel-cpp.patch

@@ -0,0 +1,33 @@
+diff --git a/eval/eval/field_backed_map_impl.cc b/eval/eval/field_backed_map_impl.cc
+index cd56f51..4d2a546 100644
+--- a/eval/eval/field_backed_map_impl.cc
++++ b/eval/eval/field_backed_map_impl.cc
+@@ -117,7 +117,9 @@ int FieldBackedMapImpl::size() const {
+ const CelList* FieldBackedMapImpl::ListKeys() const { return key_list_.get(); }
+
+ absl::optional<CelValue> FieldBackedMapImpl::operator[](CelValue key) const {
+-#ifdef GOOGLE_PROTOBUF_HAS_CEL_MAP_REFLECTION_FRIEND
++#ifdef XXX_GOOGLE_PROTOBUF_HAS_CEL_MAP_REFLECTION_FRIEND
++  static_assert(false);
++
+   // Fast implementation.
+   google::protobuf::MapKey inner_key;
+   switch (key.type()) {
+@@ -171,7 +173,7 @@ absl::optional<CelValue> FieldBackedMapImpl::operator[](CelValue key) const {
+     return CreateErrorValue(arena_, status.message());
+   }
+   return result;
+-#else   // GOOGLE_PROTOBUF_HAS_CEL_MAP_REFLECTION_FRIEND
++#else   // XXX_GOOGLE_PROTOBUF_HAS_CEL_MAP_REFLECTION_FRIEND
+   // Slow implementation.
+   CelValue result = CelValue::CreateNull();
+   CelValue inner_key = CelValue::CreateNull();
+@@ -228,7 +230,7 @@ absl::optional<CelValue> FieldBackedMapImpl::operator[](CelValue key) const {
+   }
+
+   return {};
+-#endif  // GOOGLE_PROTOBUF_HAS_CEL_MAP_REFLECTION_FRIEND
++#endif  // XXX_GOOGLE_PROTOBUF_HAS_CEL_MAP_REFLECTION_FRIEND
+ }
+
+ }  // namespace runtime

bazel/repositories.bzl

@@ -348,7 +348,12 @@ def _com_github_zlib_ng_zlib_ng():
     )
 
 def _com_google_cel_cpp():
-    external_http_archive("com_google_cel_cpp")
+    external_http_archive(
+        "com_google_cel_cpp",
+        patch_args = ["-p1"],
+        # Patches to remove "fast" protobuf-internal access
+        patches = ["@envoy//bazel:cel-cpp.patch"],
+    )
     external_http_archive("rules_antlr")
 
     # Parser dependencies