Allow custom insync? checking for resources

Use Case

For some use-cases - like specifying upper/lower bounds on values or set memberships ("for instance, I have a use-case where I want things to be treated as in-sync as long as the array specified in Puppet is a equal to or a subset of the array in the response from the API") - the Resource API type schema is not expressive enough. This leads to nasty workarounds, like munging up the desired values in canonicalize.

The current restriction is so that anyone dealing with raw resource data doesn't need to run the provider code to understand whether something is insync or not.

Describe the Solution You Would Like

???

Describe Alternatives You've Considered

• Add a comparison_operator key (with values like eq, min, max) to the attribute definition.
  See ASN.1/LDAP schemas for an example of data-defined comparisons.
• Add a feature that allows the provider to have a compare(a,b) method.
  This would violate one of the design principles of the Resource API, namely no provider code being needed to run for operations not related to the actual management of the resource.
• pass in a marker object similar to Deferred that encapsulates the comparison:
  age => LessThan($upper_limit)
  that is sent to the agent and evaluated there.

Additional Context

Originally filed as https://tickets.puppetlabs.com/browse/MODULES-9574.

Start by reading the Resource API type schema and the current insync? checking rules, then review how canonicalize and provider comparison are involved. Compare the proposed comparison_operator, provider compare(a,b), and Deferred-style approaches against the requirement that raw resource data remain understandable without provider code. Done means a decided design with a defined schema and behavior for bounds and set comparisons.