Add cli tool to check manifests

[syndicut]

This PR adds a cli utility to do the same policy checks as admission controller. Motivation here is to be able to check manifests against policy rules without accessing k8s cluster (e.g. in CI/CD pipeline) It also fixes bug with copying lock inside plugin instance, which causes plugin.Kill() to kill plugin prematurely.

[mark-adams]

👋 The k-rail project has been deprecated and is no longer under active development. We recommend taking a look at OPA Gatekeeper to see if it might meet your needs going forward.

Thanks for your contribution(s) to the project!