Bump OPA version from v0.67.1 to v0.68.0

[github-actions]

🗣 Description

• This pull request was created by a GitHub Action to bump ScubaGear's Open Policy Agent (OPA) executable version dependency.
• Please fill out the rest of the template that the Action did not cover.

💭 Motivation and context

• Bump to the latest OPA version v0.68.0

🧪 Testing

• Currently a human should still check if bumping the OPA version affects ScubaGear.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• PR targets the correct parent branch (e.g., main or release-name) for merge.
• Changes are limited to a single goal - eschew scope creep!
• Changes are sized such that they do not touch excessive number of files.
• All future TODOs are captured in issues, which are referenced in code comments.
• These code changes follow the ScubaGear content style guide.
• Related issues these changes resolve are linked preferably via closing keywords.
• All relevant type-of-change labels added.
• All relevant project fields are set.
• All relevant repo and/or project documentation updated to reflect these changes.
• Unit tests added/updated to cover PowerShell and Rego changes.
• Functional tests added/updated to cover PowerShell and Rego changes.
• All relevant functional tests passed.
• All automated checks (e.g., linting, static analysis, unit/smoke tests) passed.

✅ Pre-merge checklist

• PR passed smoke test check.

• Feature branch has been rebased against changes from parent branch, as needed

  Use Rebase branch button below or use this reference to rebase from the command line.

• Resolved all merge conflicts on branch

• Notified merge coordinator that PR is ready for merge via comment mention

✅ Post-merge checklist

• Feature branch deleted after merge to clean up repository.
• Verified that all checks pass on parent branch (e.g., main or release-name) after merge.

[mitchelbaker-cisa]

Smoke tests pass other than known issue with y2zj1 tenant: https://github.com/cisagov/ScubaGear/actions/runs/10907592818

Ran OPA/PowerShell unit tests and linter workflows successfully.

[schrolla]

Reviewed the code changes which look good. Ran all rego unit tests successfully. Ran Invoke-SCuBA on all products in test tenant which worked as expected. Reviewed OPA security advisories, no new advisories found.
Reviewed OPA related documentation and found no old version strings in text.

One item of note... the documentation does include a picture showing a screenshot of the left-hand menu displaying version 0.64. I'd recommend either removing the screenshot to ease maintenance for version bumps. Either way, it isn't a big enough deal to not approve the version bump here.

[mitchelbaker-cisa]

Reviewed the code changes which look good. Ran all rego unit tests successfully. Ran Invoke-SCuBA on all products in test tenant which worked as expected. Reviewed OPA security advisories, no new advisories found. Reviewed OPA related documentation and found no old version strings in text.

One item of note... the documentation does include a picture showing a screenshot of the left-hand menu displaying version 0.64. I'd recommend either removing the screenshot to ease maintenance for version bumps. Either way, it isn't a big enough deal to not approve the version bump here.

Thanks for reviewing, created a new issue for the OPA documentation you brought up. #1321

[mitchelbaker-cisa]

@nanda-katikaneni this is ready to merge.