Allow policy.json resource vs constant check

Adds the ability to check any resource's field against a constant
(literal, or string) in the policy.json file.

For instance, I can ensure that only users with field `enabled` set to
False can be deleted with the following rule:
"identity:delete_user": "False:%(target.user.enabled)s",

Or that only the `Member` role can be granted:
"identity:create_grant": "'Member':%(target.role.name)s",

Change-Id: I99688fd88c229b7566ddf6e4933412b6fd0cbdb2
Implements: blueprint policy-constant-check
DocImpact
Merge "Allow policy.json resource vs constant check"