As part of #277, we want to introduce the ability to `warn` in policies,
as well as `deny`.

This requires we introduce the new level, and make it possible to
retrieve the `warn` rule out of policies.

We can also refactor the key logic for evaluating policies' evaluation
results into a helper method, simplifying the work that needs to be done
and making it clearer in what cases something happens.

Closes #277.