Add check_is_admin to common.policy.Enforcer

Currently we have no concept of admin-ness inside Heat, so it's
not possible for deployers to specify a hierarchy within a project
such that some users have more privileged access than others.

The first step is to provide a means to specify in the policy a
rule which describes who is admin, then we can correctly set
is_admin in the context based on that rule.

blueprint: request-scoping-policy

Change-Id: Idd1fb5f4e52bda87c70830d66e0c931bfe879347
Merge "Add check_is_admin to common.policy.Enforcer"