Improve rule index to support glob.match built-in

[tsandall]

As mentioned in #1443 it's possible to implement an IAM-like policy and use partial evaluation to get good performance as long as subject/action/resource matching is limited to equality matching. However, currently, if matching is based on glob.match or regex the performance is poor because the rule indexer is ineffective.

We can extend the rule index to support the glob.match built-in function by generalizing the trie build step in the rule index.

For example:

# equality expression understood by indexer
input.resource = ["foo", _, "bar"]

# operator: =
# operand: input.resource
# operand: ["foo", _, "bar"]

glob.match("foo:*:bar", [":"], input.resource)

# operator: glob.match [":"]
# operand: input.resource
# operand: "foo:*:bar"

The rule indexer can be extended to add edges in the trie for the pattern operand by representing the pattern string as an array (e.g., "foo:*:bar" becomes ["foo", _, "bar"])

In the initial implementation we can leave super globs out.