Reject rules that reference policies in head

Congress now assumes that the table reference 'classify:servers'
refers to the 'servers' table from the 'classify' policy.
Previously people could write rules with 'alice:servers' in the
head and place that rule inside of say the 'bob' policy.  For
such rules, there were 2 options for resolving the reference:
(i) leave it as 'alice:servers' or (ii) prefix the table with
the policy in which the table is defined: 'bob:alice:servers'.
Option (i) breaks the invariant that 'alice:servers' refers to
the 'servers' table within the 'alice' policy.  Option (ii)
is confusing.

This change eliminates the problem by prohibiting rules from including
policies in the head.  It also makes schemas explicitly declare
whether they have information about all of the tables permitted
inside the policy or whether they have incomplete information.

Change-Id: I32535579818b3fce9e44115e5a9cbc46d15dcfc6