Validate subject subject in lookup resources request

[lennysgarage]

PR Template:

Describe your changes

• Noticed that passing empty objects to a LookupResourcesRequest subject body caused panics. Temporary fixture by validating the inner subject subject body.
• Added a test case to test erroring for empty objects being passed.

Example cmd:
grpcurl -plaintext -d '{"resource_type": {}, "subject": {"subject": {}}, "relation": "view"}' localhost:9000 kessel.relations.v1beta1.KesselLookupService.LookupResources
Before:

ERROR:
  Code: Internal
  Message: unknown request error
  Details:
  1)	{
    	  "@type": "type.googleapis.com/google.rpc.ErrorInfo",
    	  "reason": "UNKNOWN"
    	}

After:

ERROR:
  Code: InvalidArgument
  Message: invalid ObjectReference.Type: value is required; invalid ObjectReference.Id: value length must be at least 1 runes
  Details:
  1)	{
    	  "@type": "type.googleapis.com/google.rpc.ErrorInfo",
    	  "reason": "Invalid request"
    	}

Ticket reference (if applicable)

Related to https://issues.redhat.com/browse/RHCLOUD-33724

Checklist

• Are the agreed upon acceptance criteria fulfilled?

• Was the 4-eye-principle applied? (async PR review, pairing, ensembling)

• Do your changes have passing automated tests and sufficient observability?

• Are the work steps you introduced repeatable by others, either through automation or documentation?

  • If automation is possible but not done due to other constraints, a ticket to the tech debt sprint is added
  • An SOP (Standard Operating Procedure) was created

• The Changes were automatically built, tested, and - if needed, behind a feature flag - deployed to our production environment. (Please check this when the new deployment is done and you could verify it.)

• Are the agreed upon coding/architectural practices applied?

• Are security needs fullfilled? (e.g. no internal URL)

• Is the corresponding Ticket in the right state? (should be on "review" now, put to done when this change made it to production)

• For changes to the public API / code dependencies: Was the whole team (or a sufficient amount of ppl) able to review?

[app-sre-bot]

Can one of the admins verify this patch?

[merlante]

LGTM