Add a 'combine' policy type

This combines rules from multiple policy sets, each associated with an
IP space they are responsible for
add tests for combine

By no means complete, but giving me a better confidence that I've got
them right - see #9.
Add docs

Fixes #3.