[taratatach]

ResolveForMember checks the access of a reader on one target at a
time: it loads the doc again, then makes one request for its parent,
one for the shared roots on its path and one for the sharings, so a
list of items would cost a few requests each.

ResolveDocsForInstance takes docs already loaded by the caller and
makes at most three requests for all of them: one _all_docs for the
parents of the files, one dir-by-path find on the deduplicated union
of their ancestor paths, and one load of the sharings. A missing
parent gives an error for its target only. The reader is matched on
every sharing as the ready member whose Cozy URL has one of the
instance domains, aliases included. The email is never compared, as
the settings email of an instance is not a proof of identity.

The find and the collection of shared roots are extracted from
applicableSharingsForDoc with no change of behavior for its callers.
vfs.DirOrFileDocsByIDs loads files and folders in one _all_docs,
and vfs.NewFilePatherWithDirs computes paths from parents loaded
beforehand, without fetching again a parent known to be missing.

Extracted from #5135, whose list of personal recents checks with it
the access to the items owned by another instance of the stack.