Persona for resource admin now denied system resource access - EUCA-9301

A new aws:SystemResource policy condition is added which will evaluate
to true if the resource being accessed is a system resource. This policy
condition is added to the resource administrator roles policy to prevent
access to system resources. The new policy condition is applicable for
all services other than IAM/STS (which can use the aws:SystemAccount
condition)

Policy resource interception is generalized for use with resources other
than RestrictedTypes. The PolicyResourceContext is now used for resource
specific context during policy evaluation.

The OsgAuthorizationHandler is updated to use the PolicyResourceContext
for resource information during IAM authorization checks.

EUCA-9301
Merge remote-tracking branch 'origin/dev/sjones/EUCA-9301' into testing