Arrays on both sides of permissions rule

A session variable can be an array and a Postgres column can obviously be an array or a JSONB, however there appears to be no way to check whether any element from one array is present in another array.

**Here is an example:**
X-Hasura-Roles could be an array of roles and roles_with_access could be a Postgres column that is an array of roles that should have access to select a record. However, as far as I can tell, there is no way to build a permission rule that compares the array elements in the session variable to the array elements in the column.

**The _in operator only checks whether a single string is in an array, not whether any element of an array is equal to any element of another. This is an important capability for a lot of permissions use cases. **

Start with the permission-rule handling for the _in operator and the PostgreSQL array or JSONB cases described here. Define the expected overlap behavior for an array session variable and an array column, then add coverage for the X-Hasura-Roles and roles_with_access example.

Written by the indexing model from the issue text.