Create data-policies.xml

still missing ATLAS as there's no okay yet, addressing #515 
> Otherwise I'm perfectly fine with serving files only from the portal; I only wanted to alert on this "lack of source" from the visibility point of view of a regular end-user.

(Example: for CMS tutorial record 50 we keep both original URL and FFTs, so that the origin is well seen and can be well advertised)