Add Anvil-backed ReBAC engine

[zcourts]

Summary

• add optional anvil feature backed by the anvil-storage client crate
• implement tenant-aware Anvil client provider and pluggable schema store extension points
• map Zanzibar tuple reads/writes/checks/lists to Anvil authz APIs, including userset subject encoding

Notes

• this branch uses the local Anvil client path because the required authz read/list and coordination APIs are currently in Expose authz read/list APIs and task lease coordination anvil#10 and are not published yet
• Posthorn should provide an Anvil-object-backed schema store when wiring this backend into production

Tests

• cargo test --features anvil anvil:: --lib
• cargo test --lib
• cargo fmt --all -- --check
• git diff --check