enhance authz interface for policies

[mapuri]

This patch contains changes to:

• introduce a policy map (as discussed in our earlier meetings and inline with discussion here Proposal: Policy Extension Point moby/moby#18647 (comment))
• the authz plugin interface to allow passing policies from plugin to daemon
  • additionally, since multiple authz plugins can be chained, the policies are also passed to subsequent plugins in the chain giving them a chance to update the policy, if needed
• add the policies returned by the authz plugin to the container's config. This is visible when we do docker inspect.

Next steps:

• review this PR and see if it is inline with what we want to propose to docker folks
• update the documentation on authz plugins
• I will continue to work on implementing a authz plugin (in contiv/policyengine repo) that adheres to the updated interface
  • and possibly incorporate the structures from @jainvipin 's (soon to be sent) PR on concrete policy structures, discussion for which is already undergoing I believe on github-gist
• make changes to libnetwork and volume driver interface to accept and pass policies down to drivers
• see if we can implement the authz interface in volplugin and docknetplugin itself to avoid having a yet another daemon for storage and network policies.

Note: some of the changes are in vendor directory which implies this will possibly be merged as separate PRs in docker, if it get's accepted that is :).

/cc @shaleman @jainvipin @erikh @unclejack

[jainvipin]

@mapuri - basic structure looks right to me - thanks! Some comments:

• test cases would be added soon after
• Ref to the full-policy proposal: https://gist.github.com/jainvipin/8b1677f041534df576b2
• Makefile changes for http_proxy, while not specific to an environment, may not be needed in the final checkin

[jainvipin]

curious why warn here? if policies are not associated with the ctx, then it is ok right?

[mapuri]

this is just a log message for type assertion failure.

Yes, it is ok for no policies to be associated. If policies are not associated then we just set the map as empty on the next line so that it is not nil.

[mapuri]

@jainvipin thanks for the review.

I will update the documentation and test cases as well and push them in this PR.

[mapuri]

@jainvipin @shaleman

I have updated the policy related structure to be in line with the proposal here https://gist.github.com/jainvipin/8b1677f041534df576b2

PTAL when you get a chance.

[jainvipin]

can we incorporate direction and PeerGroupId to the code? Ref the updated doc in the link below...