Resource tag permission distinct from resource permission - EUCA-4746

The permission to view a resource tag is no longer related to the
permission to view the underlying resource. Permission on the tagged
resource is evaluated when adding a tag, it is necessary that a user can
view / delete a tag even if the tagged resource is no longer visible
(for example an image that was shared but is now private)

EUCA-4746
Fix binding namespace substitution - EUCA-4105

Namespace substition no longer substitutes message instead of namespace.

EUCA-4105
Euare policy parser now requires account ID in IAM ARNs - EUCA-5368

Previously the ARN parsing allowed letters in the account ID and did not
enforce the length (12 characters)

EUCA-5368