opa build: deny entrypoints that don't map to module tree

[srenatus]

Given a policy.rego like

package foo
default allow = false
allow { input.open == "sesame" }

It's unlikely that when a user calls opa build -t wasm -e fox/allow policy.rego, they want to have their entrypoints point to raw data, i.e. data.fox.allow. (It's more likely that they've made a typo.)

opa build should fail if the provided endpoints don't reference the module tree, but "just data".

There should be a new option that allows to go back to the old behaviour. Or perhaps we make it --entrypoint (-e) and --data-entrypoint for plain data refs. Since this will be a breaking change for users that use data refs, anyways, with the "revert to old behaviour" flag, too, we might as well just have them be explicit about their entry point types.

---

This came up in #3953, where the mis-pointed entrypoint used quotes.

[stale]

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days.