PCD-8663: add rego_hook seam for server-side computed policy

[tyler-pf9]

https://platform9.atlassian.net/browse/PCD-8663
https://platform9.atlassian.net/browse/PCD-8653

neutron_lib resolves server-side computed policy on its own _ROLE_ENFORCER, which the
service does not own, so the service cannot route it without a seam here.

rego_hook = None   # set by the service

def _check_rule(context, rule):
    credentials = context.to_policy_values()
    if rego_hook is not None:
        verdict = rego_hook(rule, credentials)
        if verdict is not None:
            return verdict
    # unchanged oslo path below

Inert on its own. Returns to the existing _ROLE_ENFORCER.authorize path unless a
service installs a hook and that hook returns non-None.

register_default raises DuplicatePolicyError from outside, so overriding the rule
from pf9-neutron is not an option. This seam is the minimum change.

Tests: 3 cases covering True, False and None.

Consumed by pf9-neutron. Supersedes #2.

Related PRs and merge order

1. pf9-watchman #90    produces the .so carrying enforce_rule
2. neutron-lib  #3     seam, must precede pf9-neutron
3. pf9-nova     #488   independent of each other
   pf9-cinder   #207
   pf9-glance   #149
   pf9-neutron  #189   needs 1 and 2

https://github.com/platform9/pf9-watchman/pull/90
#3
https://github.com/platform9/pf9-nova/pull/488
https://github.com/platform9/pf9-cinder/pull/207
https://github.com/platform9/pf9-glance/pull/149
https://github.com/platform9/pf9-neutron/pull/189

Supersedes pf9-watchman #86, pf9-nova #473, pf9-cinder #203, pf9-glance #146,
pf9-neutron #181, neutron-lib #2. Note #86 also carries
opa_out/keystone/admin_required.rego, which fixes an unrelated live 403 and should
be salvaged before that PR closes.