fix 437, properly handle unknowns in the context.

[amzn-mdamine]

Description of changes

Fixes the issues identified in #437

This change fix the validation of unknowns when validating the context.

Unit test have been added to meet the requirements specified in #437:

Some contexts containing unknowns should pass request validation, and others fail. For instance:

• if the context contains attributes foo: 1 and bar: unknown, and the schema requires foo: long and bar: string, this should pass.
• if the context contains attributes foo: 1 and bar: unknown, and the schema requires foo: string and bar:string, this should fail.
• if the context contains attributes foo: 1 and bar: unknown, and the schema requires foo: long, bar: string, and baz: string, this should fail.

Issue #, if available

Resolves : #437

Checklist for requesting a review

The change in this PR is (choose one, and delete the other options):

• A bug fix or other functionality change requiring a patch to cedar-policy.

I confirm that this PR (choose one, and delete the other options):

• Does not update the CHANGELOG because my change does not significantly impact released code.

I confirm that cedar-spec (choose one, and delete the other options):

• Does not require updates because my change does not impact the Cedar formal model or DRT infrastructure.

I confirm that docs.cedarpolicy.com (choose one, and delete the other options):

• Does not require updates because my change does not impact the Cedar language specification.

[cdisselkoen]

Thanks for this contribution!

We can also remove the TODO in the comments on typecheck_restricted_expr().

[amzn-mdamine]

Thanks for this contribution!

We can also remove the TODO in the comments on typecheck_restricted_expr().

Thank you for reviewing the PR.
I have removed the TODO comments.

[adpaco-aws]

Thanks for the contribution!

I'm not familiar with this code so I'm wondering how typechecking interacts in this case with the extensions. Is the use of unknowns already checked against the extensions before we get to this code?

[adpaco-aws]

Do we need to check if the partial-eval extension is enabled?

[adpaco-aws]

All the tests use Extensions::all_available(), but what happens if we don't use any?