wip add governance template

[mikaelarguedas]

Opening this for visibility, PoC for #130.
Will wait for the ongoing API changes to settle before deconflicting and iterating.

What's in this PR:

• New governance.xsl template to generate the governance files
• Modifies the policy format to take a new protection attribute
• change create_signed_governance_file argument order to match the ones from create_signed_permission_file
• removes creation of a keystore-wide governance file and generate one per key

Open ended questions:

• What is the best default behavior ? encrypting all data unless specified otherwise?
• Should the new attribute be required or optional ? (if optional use the default from previous bullet)

Still todo:

• cleanup code and refactor to avoid duplication
• settle on behavior in case of multiple policies to process