Copy validated declarations between checker.Env instances on extension

[TristonianJones]

This change introduces several small changes to improve environment extension and CEL bootstrapping.

Type-substitution Utility

Introduce a common helper method for performing type substitution checks. The helper method scopes
the use of proto.Equal within internalIsAssignable to only the cases where recursive type substitutions
occur. All other branches progressively narrow the types under consideration and use simpler checks
appropriate for the protobuf type.

This change improves check-time performance roughly 40% per issue #346.

EagerlyValidateDeclarations Option

When this option is enabled, a guaranteed to compile expression is parsed and type-checked ensuring that
the internal instance of the checker.Env is initialized and all declarations provided as options to the
cel.NewEnv() call are checked to ensure there are no overlapping / colliding function declarations.

Using this option in combination with Extend also makes it possible to copy the already validated
declarations into the cloned checker.Env of the extended environment. The cloned declarations are
shallowly copied on checker.Env initialization. If a declaration provided to the derived environment
needs to be merged with a function type declared in an ancestor environment, the ancestor function
is copied prior to being modified to ensure changes are isolated to the derived environment.

NewEnv() Extends by Default

The NewEnv() call now extends a globally initialized copy of the CEL standard environment whose
declarations have been validated as part of an init() call. This means in the common case that when
only a few declarations or parameters are changed as part of the CEL standard environment, the internal
checker.Env setup cost is kept to a minimum.

Filtered Overloads

The support for CrossNumericTypes was filtering overloads on addition to the checker.Env. This
behavior has now been shifted to filtering on access of the overload set within the type-checker.
Without this change it was impossible to toggle CrossNumericTypes support between Extend
calls.

Performance

The performance impact of these changes is dramatic, dropping the cost of the simple case by >95%

benchmark                          old ns/op     new ns/op     delta
BenchmarkNewEnvLazy-8              14748         13535         -8.22%
BenchmarkNewEnvEager-8             2506297       61987         -97.53%
BenchmarkEnvExtendEager-8          2658853       62218         -97.66%
BenchmarkEnvExtendEagerTypes-8     2742668       65600         -97.61%
BenchmarkEnvExtendEagerDecls-8     2650621       102302        -96.14%

benchmark                          old allocs     new allocs     delta
BenchmarkNewEnvLazy-8              97             39             -59.79%
BenchmarkNewEnvEager-8             20283          209            -98.97%
BenchmarkEnvExtendEager-8          20300          204            -99.00%
BenchmarkEnvExtendEagerTypes-8     20205          221            -98.91%
BenchmarkEnvExtendEagerDecls-8     20409          474            -97.68%

benchmark                          old bytes     new bytes     delta
BenchmarkNewEnvLazy-8              10489         7634          -27.22%
BenchmarkNewEnvEager-8             578535        18031         -96.88%
BenchmarkEnvExtendEager-8          581087        17801         -96.94%
BenchmarkEnvExtendEagerTypes-8     576225        20088         -96.51%
BenchmarkEnvExtendEagerDecls-8     579028        27177         -95.31%

[TristonianJones]

@JimLarson Do you think you'd be able to take a look at this? I realize more extensive refactors are probably necessary, but looking this change again, it does make the code easier to decipher (imo).

[JimLarson]

I don't think I'll be able to reload the state in my head to make sense of this anytime soon, so approving to get it off my review list and unblock you.

[jpbetz]

LGTM

I added a few comments, mostly questions and one optional change.

The test coverage and benchmarks look solid. This covers the use case needed by Kubernetes really well.

I did not review the checker/types.go. I don't feel like I understand the specifics well enough there to be helpful. All the validatedDeclarations code made sense to me.

[jcking]

This seems...hacky. But okay.

[TristonianJones]

Ah, yes, the compile is a bit hacky. Let me just do the checker construction here.

[TristonianJones]

@jpbetz Once the release is cut would you mind just updating the #519 ticket with the updated performance graph?

Closes #346

[jpbetz]

@jpbetz Once the release is cut would you mind just updating the #519 ticket with the updated performance graph?

I'd be happy to.