Enable polices to match nodes directly.

Added commands 'add-policy-node' and 'remove-policy-node'

NOTE: I know this is being actively debated/discussed.  I hope this will
illustrate what I want to achieve.

ALSO NOTE: This should merge cleanly over the current master But
will not over some of the other PRs that are under review.

This change allows for policies to have a static list of nodes it will
match.  This allows a policy to match a predefined, static list of nodes
that are specifically targeted. Allowing the bypassing of having to
create one to one tags for nodes (e.g:

  {
    "name": "node1",
    "rule": ["eq", ["fact", "macaddress"], "01:01:01:01:01:01"]
  }

Policies can have both a list of nodes to match and a list of tags to
match.  Normal policy ordering applies, having a node on a policy
directly does not mean that the policy will have a higer priority for
that node.  I.e. if another policy higher up the order matches a node
via tags, it will still bind over a lower priority policy that would
match direct.

Note that an additional association between policies and nodes needed to
be created in the respective Razor::Data classes.  The existing
association that associated a node to its binding policy was renamed to
'bound_policy'.  A helper method called 'policy' exists on the node to
retrive 'bound_policy' however this is really just to support backwards
compatibility in installer templates.  I think all the internal code
refers to node.bound_policy.

This change is to better support the use case of environments where
machines would only ever be explicitly provisioned rather than auto
provisioned based on a policy.