built-ins: add object.subset() builtin

[charlesdaniels]

This implements the new object.subset() builtin.

Fixes #4358

Signed-off-by: Charles Daniels charles@styra.com

[charlesdaniels]

I have created a simple benchmark in topdown/topdown_bench_test which compares the new builtin against the code @anderseknert wrote as an example in #4358. It looks like this is roughly a 50% speedup. Testing environment was a 2021 14 inch MacBook pro with an Apple M1 Pro and 32GB RAM, running macOS 12.3.1, with Go version 1.17.6 darwin/arm64. The benchmark output is as below:

$ go test -bench BenchmarkObjectSubset ./topdown/
2022/06/07 17:32:25 http: TLS handshake error from 127.0.0.1:61763: remote error: tls: bad certificate
2022/06/07 17:32:25 http: TLS handshake error from 127.0.0.1:61961: remote error: tls: bad certificate
2022/06/07 17:32:25 http: TLS handshake error from 127.0.0.1:61962: remote error: tls: bad certificate
2022/06/07 17:32:25 http: TLS handshake error from 127.0.0.1:61963: remote error: tls: bad certificate
2022/06/07 17:32:25 http: TLS handshake error from 127.0.0.1:61964: remote error: tls: bad certificate
2022/06/07 17:32:25 http: TLS handshake error from 127.0.0.1:61976: remote error: tls: bad certificate
goos: darwin
goarch: arm64
pkg: github.com/open-policy-agent/opa/topdown
BenchmarkObjectSubset/10-8    	   60330	     19301 ns/op
BenchmarkObjectSubset/100-8   	    9763	    123669 ns/op
BenchmarkObjectSubset/1000-8  	     895	   1330247 ns/op
BenchmarkObjectSubset/10000-8 	      64	  18523701 ns/op
BenchmarkObjectSubsetSlow/10-8         	   28956	     43153 ns/op
BenchmarkObjectSubsetSlow/100-8        	    3853	    307680 ns/op
BenchmarkObjectSubsetSlow/1000-8       	     376	   3243462 ns/op
BenchmarkObjectSubsetSlow/10000-8      	      32	  36435461 ns/op
PASS
ok  	github.com/open-policy-agent/opa/topdown	13.568s

The "slow" tests are done using pure Rego, while the other tests use the new builtin.

[srenatus]

Looks good, just nitpicks.

I'm working on getting the metadata change related to the last release fixed here, #4753, so if you could rebase, I'd appreciate that. Running make generate should be enough to have only the needed sections added.

[charlesdaniels]

In bbb127862c8b6a8fb32303a55c2fef5531b43a13, I have spent some time with the profiler and have made some low hanging fruit optimizations. I am reasonably confident that this doesn't leave performance on the floor, except for array subset using an O(n^2) naive algorithm rather than Boyer-Moore or something similar.

The new speedup over pure Rego is 2.77x, compared to 1.97x with the initial version of this PR.

[srenatus]

Thanks for bearing with me. The tiniest nitpicks only 🙃 👇

[srenatus]

Thank you! LGTM

[charlesdaniels]

No changes, just need rubber stamp after rebasing.