improving match criteria debuggability

[acpana]

At present, we only record results that match a constraint match criteria:

frameworks/constraint/pkg/client/template_client.go

Lines 135 to 140 in 3f237e2

	for name, constraint := range e.constraints {
	cResult := constraint.matches(target, review)
	if cResult != nil {
	result[name] = *cResult
	}
	}

We can improve the debuggability of the system by A) indicating that a constraint doesn't match for a review and B) any stats on time it takes to run the match for a constraint. Both of these can help with UX efforts in shift left case scenarios like open-policy-agent/gatekeeper#2599

[maxsmythe]

What is a "shift case scenario"?

[maxsmythe]

"shift left"? The time of enforcement is irrelevant WRT its usefulness.

That being said, it should be opt-in for the purpose of limiting verbosity.