Obtaining the list of ERC721 tokenIds owned by an account

ERC721 has no way to retrieve all tokenIds owned by an account, such as the tokensOf function that was at some point part of the draft but removed before becoming final. We discussed bringing that function back in https://github.com/OpenZeppelin/openzeppelin-solidity/pull/856 but decided against it.

There is a function tokenOfOwnerByIndex that allows iterating the owned tokens one by one, but this will probably result in terrible performance and also suffers race conditions.

It's not clear what is the correct way for programs, including dapps, to retrieve all of the tokens owned by an account. It would be very useful if OpenZeppelin included documentation or helpers related to this task.

There was already a few proposals in the comments of https://github.com/OpenZeppelin/openzeppelin-solidity/pull/856, which I encourage those interested to read. There was mention of events, off-chain indexing (e.g. gnarly), JSON-RPC batching (apparently a non-solution), an auxiliary querier contract (https://github.com/OpenZeppelin/openzeppelin-solidity/pull/856#issuecomment-406768864), and even using said contract via eth_call.

We need some research done on the feasiblity of those approaches, their performance, as well as other alternatives, with the objective of making a recommendation to OpenZeppelin users and the ERC721 ecosystem in general. There may already be a solution out there that we haven't heard about!

Start by reading the discussion and proposals in pull request #856, including the auxiliary querier contract and off-chain indexing ideas. Compare the mentioned approaches and other alternatives for feasibility and performance, then document a recommendation for OpenZeppelin users and the ERC721 ecosystem.