Always handle rules as dicts keyed by app

In most cases, this is the useful form.  And in particular for tests
that address only one app (the most common kind), this allows much
quicker access to the relevant rules.