Allow `import` operator to shut down at frontier

Some uses of differential dataflow aim to observe an output at a specific time and then walk away from the dataflow. Such a case must currently start a streaming dataflow, await the visibility of results, and then pro-actively shut down the input source.

It seems that an import operator should be able to take instruction about when to drop its capability and cease propagating batches. For example, one could supply a vector of timestamps with the intended semantics that the output must be correct for any time less or equal an element of the vector. Once the trace's upper frontier is not less or equal to any element of the vector it can drop its capability. Batches can also be filtered, unless this breaks everything horribly, by looking at the differences between its upper and lower frontiers and seeing if any timestamps are greater or lower than this bound.

Start by locating the import operator and reading how it currently propagates capabilities and batches. Work out the proposed frontier semantics for dropping capability and filtering batches, then add focused coverage showing that outputs remain correct through the requested timestamps and that propagation stops afterward.