Fixes #4464 - policy for foreman-proxy

This is preliminary policy for proxy, feel free to review and *test*.
Instructions how to easily test will follow.

What was tested so far:

* create host
* edit host
* rebuild host
* delete host
* list puppetca certificates

PLEASE I NEED YOUR ASSISTANCE WITH HELPING TO TEST THIS POLICY. It is piece of
cake to test it, won't break your existing instance at all. Read the
instructions in my comments bellow.
> any ideas why these things are needed, when sudo has its own domain?

This does not do any transition, these are rules to actually allow our
domain to execute sudo, nothing else. We can't really change to sudo_t
it's meant for other purposes.

Basically these rules are necessary to do the change to `root`. I am not
going to add TYPE/ROLE support via `sudoers` file for this cut. We only
need few rules to operate properly, therefore transitions into domains
of the underlaying services would be an overkill.

-- 
Later,
 Lukas #lzap Zapletal