Fix missing policy enforcement in CFN API

Currently the CreateStack and UpdateStack actions aren't correctly
enforcing the policy, so add calls to _enforce which fixes that,
and rework the test to illustrate the issue.

Change-Id: Ia5c2e65512ab9d1c163171f8617c081ab96745e5
Closes-Bug: #1256049
Merge "Fix missing policy enforcement in CFN API"