Directory.openInput should not directly return IndexInput [LUCENE-6757]

Spinoff from #7803 suggested by @rmuir.

It's dangerous today that Directory.openInput returns an IndexInput which you can then use for IO but also clone so other threads can do thread-private IO.

We could instead make this strongly typed, e.g. Directory.openInput returns a thingy (Handle, Descriptor, something) whose sole purpose is to 1) produce IndexInput for thread-private use, and 2) close.

In the meantime, we could add some simple asserts to MDW to detect if the "original" IndexInput is ever use for anything but cloning, when other threads have cloned / do clone in the future. I'll explore that first ... it's a start.

---
Migrated from [LUCENE-6757](https://issues.apache.org/jira/browse/LUCENE-6757) by Michael McCandless (@mikemccand)

Start by reading the Directory.openInput and IndexInput APIs, then review the discussion in #7803 and the references to MDW in this issue. The issue does not define a settled implementation or acceptance criteria; completion would require deciding between a strongly typed handle and interim assertions that restrict the original IndexInput to cloning.

Written by the indexing model from the issue text.