feat(import): resolve references and schema composition

crates/crank-config/src/process/external_references.rs

@@ -0,0 +1,24 @@
+#[derive(Clone, Eq, PartialEq)]
+pub struct ExternalReferenceSettings {
+    /// Canonical HTTP(S) URL prefixes which opt an operator into remote `$ref` fetches.
+    /// An empty list is a deliberate default-deny switch.
+    pub allowed_url_prefixes: Vec<String>,
+    pub max_depth: usize,
+    pub max_documents: usize,
+    pub max_fetch_bytes: usize,
+    pub fetch_timeout_ms: u64,
+    pub max_expanded_nodes: usize,
+}
+
+pub(super) fn parse(parser: &mut super::Parser<'_>) -> ExternalReferenceSettings {
+    ExternalReferenceSettings {
+        allowed_url_prefixes: parser
+            .url_prefix_list("CRANK_IMPORT_EXTERNAL_REFERENCE_ALLOWED_URL_PREFIXES"),
+        max_depth: parser.number("CRANK_IMPORT_EXTERNAL_REFERENCE_MAX_DEPTH") as usize,
+        max_documents: parser.number("CRANK_IMPORT_EXTERNAL_REFERENCE_MAX_DOCUMENTS") as usize,
+        max_fetch_bytes: parser.number("CRANK_IMPORT_EXTERNAL_REFERENCE_MAX_FETCH_BYTES") as usize,
+        fetch_timeout_ms: parser.number("CRANK_IMPORT_EXTERNAL_REFERENCE_FETCH_TIMEOUT_MS"),
+        max_expanded_nodes: parser.number("CRANK_IMPORT_EXTERNAL_REFERENCE_MAX_EXPANDED_NODES")
+            as usize,
+    }
+}