Overhaul Upserts in 4.x

[zachdaniel]

Upserts are currently very "dumb", insofar as they do not apply any action logic. From a conceptual standpoint, however, they can and should be modeled as a "create or read and update" operation. To accomplish this, the following changes would be made:

Introduction of four new options:

• upsert_read_action - defaults to primary read
• upsert_update_action - defaults to primary update
• authorize_upsert_read - defaults to true
• authorize_upsert_update - defaults to true

If authorizing the read, then the authorization rules of the primary read will be applied to changeset.filter.
If authorizing the update, then the authorization rules of the update will be applied to changeset.filter, using error(...) to produce a forbidden error in data layers that support it.