Release v4.27.0

Added

• Policies that check only a role or only a claim render as Arc policies. Signed-in callers with the role or claim are allowed; everyone else, including callers who are not signed in, is denied. Roles are read through the identity's role claim type. (part of #57)
• claim matches subject works against Uuid subjects. The claim must equal the Uuid's canonical text exactly (lower-case, hyphenated), as in Screenplay's reference semantics, in generated applications and in Stage's own specification runner; a missing claim or any other spelling denies. (part of #57)

Changed

• Specifications whose caller is not signed in but carries roles or claims are refused with STAGE-ESM-011, because Arc removes roles and claims from callers who are not signed in. (part of #57)