feat: add ulims authz policy

[MattPrit]

Summary: Adds authZ policy for use in ULIMS services. Essentially, this moves the existing ULIMS policy into the central repository, with the addition of service account support and a new rule for filtering a list of instruments

Added rules:

• allow - top-level check that the user has been verified
• session_restrictions - returns the sessions that the user has access to, in the format [{"beamline": "i03", "proposal_number": 1, "visit_number": 1}, ...]
• filter_sessions - given an input instrument_sessions of (proposal number, session number) pairs, return those pairs corresponding to session that the user has access to
• filter_instruments - given an in put instruments, a list of instrument names, return those that the user has access to (i.e is an admin of)

Note: There is a section of policy that I have copied from tiled.rego

Note: Some of the rules depend on token.claims.beamline, I suspect that more generally we would like token.claims.instruments, but I have used beamline for consistency with tiled.rego