Syncing changes from oslo-incubator policy engine

In this patch, I have copied required changes from oslo-incubator
policy module from commit 0da5de6b548d34300a75f80bf87d6a809c609d2f.

This changes are required for implementation of blueprint
restrict-downloading-images-protected-properties.

blueprint: restrict-downloading-images-protected-properties
Change-Id: I00653411cd0a92503a3096c0dde07e1d6a229353
Merge "Syncing changes from oslo-incubator policy engine"