EXPERIMENTAL: Add reader.Checks() & ds.checks implementations

[gertd]

This PR adds support for a boxcar version of the Check() API, allowing multiple Check requests to be sent in a single roundtrip as well as the corresponding ds.checks built-in function.

The default block provides optional default values that will be substituted into the final check request when entries are left empty, eliminating the need for repetition and reducing the request's size.

Example Checks request with defaults:

grpcurl -insecure -d '{
    "default": {
      "object_type": "folder",
      "object_id": "root",
      "subject_type": "user",
      "subject_id": "[email protected]",
      "trace": false
    },
    "checks": [
      {
        "relation": "owner"
      },
      {
        "relation": "can_read"
      },
      {
        "relation": "can_write"
      },
      {
        "relation": "can_share"
      }
    ]
  }' localhost:9292 aserto.directory.reader.v3.Reader.Checks
{
  "checks": [
    {
      "check": true,
      "context": {}
    },
    {
      "check": true,
      "context": {}
    },
    {
      "check": true,
      "context": {}
    },
    {
      "check": true,
      "context": {}
    }
  ]
}

ds.check() built-in example

x = ds.checks({
  "default": {
    "object_type": "folder",
    "object_id": "root",
    "relation": "",
    "subject_type": "user",
    "subject_id": "[email protected]",
    "trace": false
  },
  "checks": [
    {
      "relation": "owner"
    },
    {
      "relation": "can_read"
    },
    {
      "relation": "can_write"
    },
    {
      "relation": "can_share"
    }
  ]
})

The current execution strategy is fan-out-fan-in; requests are fanned out to be executed in parallel, with a maximum degree of parallelism based on runtime.GOMAXPROCS(0); results are fanned in to a single response message. IOW, we wait for the last response to return before sending the ChecksResponse message.