Add support for a policy resource to Teleport

[xacrimon]

This PR adds support for a predicate based policy resource to Teleport. It primarily contains expressions that will be evaluated by a predicate (the internal expression language) based evaluator. This PR pairs with gravitational/predicate-lang#17. See that PR for the practical usage for the resource & commands introduced by this PR.

@klizhentas Should we keep predicate related changes in a separate branch or merge to master?

EDIT: I've changed the target branch to dev-predicate.

[fspmarshall]

Is there an RFD or design doc for this somewhere? Hard to give a meaningful review without more context. I'm hesitant to add something like this to the public API without a clear idea of how the feature as a whole will work.

[fspmarshall]

Should we keep predicate related changes in a separate branch or merge to master?

IMO if there isn't an RFD yet, this should have its own separate dev branch for now.

[xacrimon]

@fspmarshall Seems apt, I've changed the base to a dev-predicate branch for the time being. We don't really have an RFD for this yet as it's an an exploration phase. The rundown is:

• Tooling from https://github.com/gravitational/predicate-lang will automatically convert policies defined in a Python DSL into this resource, the various fields being expressions understood by Teleports existing parser/evaluator mechanism for where expressions
• Checks will be introduced later to also query an RBAC engine that works by evaluating these expressions, working in addition to the existing RBAC system

This PR provides a more practical example of the admin-side of things.

[github-actions]

@xacrimon - this PR is large and will require admin approval to merge. Consider breaking it up into a series smaller changes.

[nklaassen]

Code looks fine, just a couple comments on comments and naming. I don't want to block this from merging to a dev branch but I do thing policy is probably too generic of a name

[russjones]

@xacrimon Investigate if we need to add this resource into the cache system. I seem to remember having to add resources into some giant switch statement whenever I had to do this.