Allow managing policy files

Ideally, those would somehow be covered by validation (like we do for normal configuration via cue) but I’m not sure how to best do that. (-> Validation transferred into issue #129 (closed))

It is a requirement for secustack as described in #113 (closed).

In secustack the following services require non-default policies, and should therefore have the highest priority:

• Nova (!235 (merged))
• Cinder (!237 (merged))
• Barbican Adding policy support for barbican is included in #105 (closed).
• keystone moved to issue #137 (closed)
• glance moved to issue #138 (closed)
• neutron moved to issue #139 (closed)
• horizon moved to issue #140 (closed)