Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
There is a danger in making a default implementation here.  The danger is that it'll be assumed to be part of base k8s and that users will assume that it is there.  I'd rather do something like have a default that just allows everything and then perhaps a simple file based policy engine on the master (or etcd?).  We can build out an API based engine as we see the need.  Our default install would use the 'yes' engine.