Prevent leaking `target` info into subsequent `policy.check()` calls

Due to mutable dictionary being used as the default `target` argument
value the first target calculated from scratch in POLICY_CHECK
function will be used for all subsequent calls to POLICY_CHECK with 2
arguments. The wrong `target` can either lead to a reduced set of
operations on an entity for a given user, or to enlarged one. Due to
independent policy checks at each service's side this doesn't pose a
serious security breach, but can lead to weird UX behaviour.

Change-Id: I744fac28de0fb7060b50c5db689e74631a628c88
Closes-Bug: #1396544
(cherry picked from commit dab964d781699d07883a659750c6913b649fed38)
Merge "Prevent leaking `target` info into subsequent `policy.check()` calls" into stable/icehouse