bakery/checkers: add Declared and InferDeclared

This allows macaroons to declare information by adding a first-party
caveat. The declarations inferred are valid after caveat checking because
we guarantee to check all discharge macaroons when verifying. A client can
add another declaration caveat, but they can't change the value of an existing
declaration.

To come: built in support for third party caveats that require a set of
declarations to be added when discharged.
Sounds like a good enough resolution. I wonder if there is a situation where this behaviour would be wrong. it would be nice to have a proof that this this false negative never happens.