Remove references to hard-coded policy classes

This makes some policy resolution configurable.

• nil by default resolves to DeclarativePolicy::NilPolicy, which is a deny-all policy.
• no other policies are defined by default.
• symbols are treated as names, and looked up in a policy registry.

The policies for nil and named policies can be configured by an initializer.

Documentation is added for configuration and policy definition.

Closes: #5 (closed)