Partial schema validation

[john-h-kastner-aws]

Experimental implementation of partial schema validation as described in cedar-policy/rfcs#8.

The experimental implementation does not include the additionalMemberOfTypes and additionalMemberOf fields discussed in the RFC. I'm not convinced these are neccecary for the feature as a whole to be useful, and they require additional changes inside existing validation code.

I'm marking this ready for review as an experimental feature, so reviewers do not need to review the semantics of partial schema validation. They should be sure to review:

1. Changes which ensure partial schema validation is in fact experimental, i.e., it's properly placed behind the partial-schema feature.
2. That the code changes are should not effect the behavior of the strict validator.

[mwhicks1]

Some comments on the writeup:

RequestEnv is now an enumeration which of either the request context as it was previously defined, or RequestEnv::Unknown.

This is a single catchall for handling missing actions, and also missing principals/resources associated with a particular action. Would it be worthwhile to include a specific action in the cross-product, but associated with an unknown principal or resource, in case the listed principalTypes or resourceTypes are incomplete?

An undeclared entity type has an open attributes record, but a declared entity type without an explicitly defined attributes record has a closed attributes record by default. This is a bit weird.

Why is it weird? Seems natural to me: The fact that you are explicitly declaring the entity in your schema, with an empty record, means you are taking a stand on it. If you want it to be open, you have to declare it as open, in the schema.

Same comment about not including a memberOfTypes element -- what you have seems right to me.

[mwhicks1]

I didn't review all the testing code, just to get this posted sooner. Will do that on the next review.

[john-h-kastner-aws]

I'm making some tweaks to in, so I'll look at the comments there once I'm done with that

[khieta]

High-level comment: it would be helpful for review to split this PR into two: one for incidental refactoring and one for changes that need to be behind the partial validation flag.

But overall looks fine, so approving as-is.

[khieta]

Add tests for templates/linked policies too.

[khieta]

Also might make sense to move this change to a separate PR.