feat: add check engine

[zepatrik]

Proposed changes

This adds an engine that is able to check permission requests.
In the relation model, the key UserID was renamed to SubjectID as it can contain users and user sets alike.

The algorithm works by breadth first search. It walks the graph of relations that apply to one subject recursively and checks whether there is a path from subject to object containing an edge labeled relation name.

The following example pictures simple relations and the corresponding graph (notation like in the zanzibar paper):

organization#member@user              <-- user is member of organization
object#owner@(organization#member)    <-- every organization member is owner of object
object#write@(object#owner)           <-- every object owner is allowed to write object

Request could be e.g.:

object#write@user            <-- is user allowed to write object?