Pin GOPAL 2.0.0, and repair what the bump exposed

[kmadan]

Bumps aicertify/opa_policies from 9950848 (v1.3.0-58) to
0482ec9
(v2.0.0).

The pin was 17 commits behind and had not moved since before GOPAL's
declarations migration, so bumping it surfaced two unrelated breakages at once.

Verified against both pins, which is the only way to tell them apart:

45 passed  against the old 1.x pin
 4 failed  against 2.0.0
216 passed after the fixes in this PR

From GOPAL 2.0.0: the alias table is one-to-one

Three tests asserted the old contract — at least 20 aliases, a named legacy
spelling present, and a legacy spelling resolving to the policy that computes
the metric. They now assert the opposite. A gap report that still resolved a
retired spelling would mark a requirement as met while the value never
reaches a rule, which is the same failure mode the gap report exists to catch.

test_aliases_are_parsed_not_just_the_keys keeps its original purpose. The
parser once returned every canonical name with an empty alias list, and an
empty list looks like a working parser from outside. Now that the table is
one-to-one, an entry parsed as empty and an entry parsed as itself are
indistinguishable by count, so it asserts both that no entry is empty and that
the total equals the number of metrics.

From the earlier declarations migration: a test that checked nothing

test_parsed_fields_match_what_the_policy_reads built its expected set with

re.findall(r"input\.([a-z_]+\.[a-z_]+)", source)

Every declaration read in GOPAL is now
declarations.resolve(input, ["a", "b"]), so that regex matched nothing,
read_paths was empty, and the for loop over it asserted nothing at all. The
test had been green while checking nothing since the migration landed.

It now recognises both read forms and refuses to run on an empty set on either
side, so the same silent-vacuum cannot recur.

Not changed

summary.toxicity_values still written; report generation reads it. It is no
longer a GOPAL input.