Policy source data format proposal

[jan-cerny]

This is the policy source data format that we will use to improve
development of our profiles. It will allow us to store security controls
and requirements in the repository and then define profiles by using
their IDs instead of separate rules.

This is done in order to solve the problem that there is no easy way to
demonstrate to profile stakeholder the status of their profile.

Intended workflow:

• SME identifies security controls the policy consists of. Those
  controls serve as direct input for our profiles.
• SME goes through controls, and makes sure that they are sufficiently
  covered by rules.
• SME fine-tunes the profile by overriding a couple of individual rules
  in the profile file.

Once the format is accepted we can start developing tools that support
this new workflow.

In future, we can also use it for further refactoring, for example
streamlining the generation of HTML tables.

Add comments as if you review the code.

[openshift-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[redhatrises]

NACK.

[shawndwells]

Other standards exist for this, nor is this a problem for content authors or consumers. NACK.

[matejak]

Gentlemen, are you serious? This proposal is

• a backwards-compatible improvement for content maintainers and content creators,
• completely unrelated to consumers, and
• indifferent to other standards.

In order to close this PR, please specify some material reasons and not just NACK. This is an open-source project, and if we support Python 2.7 or SLES 11, we can as well support a wider range of possibilities how to write and maintain profiles if they don't break anything.

[redhatrises]

This PR received multiple nacks including publicly AND privately from customers, so yes.
SMEs and SME content creators don't have this problem and aren't in need of this.

[jan-cerny]

@redhatrises I will try to invent a different proposal instead. But please let me know what are the specific problems in this one or which things need to be done differently.