access policy widget: handle policies with no rules

We need the AccessPolicy#rules attribute to always be a Collection
object, even if it contains no actual rules.

Bug: 1160513
Change-Id: I7629510cb3fe1a2f112f132c36ea586dbe00f3e3
bkr system-modify --condition

Bug: 804479
Change-Id: Ie80ffb29c9635989be82dfa9ad33fd04fa25ba01