Relationships API proto

Relationships API - protobuf contract (R5): gen... (gitlab-org/gitlab#599075 - closed)

This MR introduces the first iteration of the Relationships API (R5) protobuf contract, scoped to what Artifact Registry needs for its .com go-live per AUTH-014. It is not the target-state contract.

In this iteration the schema covers:

• Subject-centric reads (ReadRelationships) for the auth hot path
• Atomic batch writes and deletes (WriteRelationships / DeleteRelationships)
• Membership tuples only — containment, link, and custom roles are deferred per AUTH-014

What's deliberately left out of this MR:

• The GLAZ embed check_permission contract for the interim (host-supplied tuples + ancestors + attributes). That's a separate piece of work — this MR only defines how those tuples are stored and read.
• Inverse lookup RPCs (e.g. "who has access to this resource?")
• Anything the target state (AUTH-018, GATE L1) will require — once Envoy/STS are in place, GLAZ fetches its own data and this contract's role narrows.

Forward-compat is built in: custom roles, additional relation types (containment/link), group-as-subject, and new optional filters can all be added without breaking the contract.