Fix detached-metadata issues

Build a more robust system for determining this regardless of scope.
Lean in on the OPA parser failing anyway when scope is invalid.

Fixes #1138

Signed-off-by: Anders Eknert <anders@styra.com>

bundle/regal/rules/style/detached-metadata/detached_metadata.rego

@@ -9,7 +9,7 @@ import data.regal.result
 import data.regal.util
 
 report contains violation if {
-	some block in ast.comments.blocks
+	some i, block in ast.comments.blocks
 
 	startswith(trim_space(block[0].text), "METADATA")
 
@@ -18,8 +18,7 @@ report contains violation if {
 	# no need to +1 the index here as rows start counting from 1
 	trim_space(input.regal.file.lines[last_row]) == ""
 
-	annotation := _annotation_at_row(util.to_location_object(block[0].location).row)
-	annotation.scope != "document"
+	not _allow_detached(last_row, i, ast.comments.blocks, input.regal.file.lines)
 
 	violation := result.fail(rego.metadata.chain(), result.location(block[0]))
 }
@@ -29,3 +28,16 @@ _annotation_at_row(row) := annotation if {
 
 	util.to_location_object(annotation.location).row == row
 }
+
+_allow_detached(last_row, i, blocks, lines) if {
+	next_block := blocks[i + 1]
+
+	startswith(trim_space(next_block[0].text), "METADATA")
+
+	next_block_row := util.to_location_object(next_block[0].location).row
+	lines_between := array.slice(lines, last_row, next_block_row - 1)
+
+	every line in lines_between {
+		line == ""
+	}
+}

bundle/regal/rules/style/detached-metadata/detached_metadata_test.rego

@@ -61,7 +61,7 @@ allow := true
 	r == set()
 }
 
-test_success_detached_document_scope_ok if {
+test_success_detached_but_more_metadata_on_rule if {
 	r := rule.report with input as ast.with_rego_v1(`
 # METADATA
 # scope: document
@@ -74,6 +74,44 @@ allow := true
 	r == set()
 }
 
+test_success_detached_but_more_metadata_on_package if {
+	r := rule.report with input as regal.parse_module("p.rego", `
+# METADATA
+# scope: package
+# description: foo
+
+# METADATA
+# title: allow
+# scope: subpackages
+package p
+`)
+	r == set()
+}
+
+test_fail_second_block_detached_first_not_reported if {
+	r := rule.report with input as regal.parse_module("p.rego", `# METADATA
+# scope: package
+# description: foo
+
+# METADATA
+# title: allow
+# scope: subpackages
+
+package p
+`)
+	r == {{
+		"category": "style",
+		"description": "Detached metadata annotation",
+		"level": "error",
+		"location": {"col": 1, "file": "p.rego", "row": 5, "text": "# METADATA"},
+		"related_resources": [{
+			"description": "documentation",
+			"ref": config.docs.resolve_url("$baseUrl/$category/detached-metadata", "style"),
+		}],
+		"title": "detached-metadata",
+	}}
+}
+
 test_success_not_detached_by_comment_in_different_column if {
 	r := rule.report with input as ast.with_rego_v1(`
 # METADATA