Limit AAF top level filter policies to our groupID to remove impact on bilateral agreements IdP might have.

The initial report for this issue impacted specifically Microsoft O365.

We're currently populating:

    <AttributeFilterPolicy id="afp_default_for:aaf.edu.au">
        <PolicyRequirementRule xsi:type="basic:ANY" />
        <AttributeRule attributeID="persistentID">
          <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
        <AttributeRule attributeID="transientId">
          <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>

Ideally we should be limiting this to our entities descriptor groupID so as not to impact on bilateral agreements AAF IdP might have e.g.

    <AttributeFilterPolicy id="afp_default_for:aaf.edu.au">
        <PolicyRequirementRule xsi:type="saml:AttributeRequesterInEntityGroup" groupID="aaf.edu.au" />
        <AttributeRule attributeID="persistentID">
          <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
        <AttributeRule attributeID="transientId">
          <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>