RFC 503: Add authz.SubRepoChecker to GitTreeResolver

Created by: ryanslade

This would stop us from needing to make the subRepoPermsClient a replaceable function.

GitTreeResolver is created in 11 places currently so we should standardise on a constructor and ensure that the checker interface is required.