Restrict enforcer to INITIAL clockwork state

This was the behavior of old policy enforcer hook. We keep it
avoid unexpected change in functionality.

(cherry picked from commit 9ea88e4)

model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/lens/projector/focus/FocusProcessor.java

@@ -23,6 +23,7 @@
 
 import javax.xml.datatype.XMLGregorianCalendar;
 
+import com.evolveum.midpoint.model.api.context.ModelState;
 import com.evolveum.midpoint.model.impl.lens.projector.policy.PolicyRuleEnforcer;
 import com.evolveum.midpoint.model.impl.lens.projector.policy.PolicyRuleProcessor;
 import com.evolveum.midpoint.prism.*;
@@ -279,9 +280,12 @@ private <F extends FocusType> void processFocusFocus(LensContext<F> context, Str
 						() -> policyRuleProcessor.evaluateObjectPolicyRules(context, activityDescription, now, task, result),
 						partialProcessingOptions::getFocusPolicyRules);
 
-		        // If partial execution for focus policy rules and for assignments is turned off, this method call is a no-op.
-				// So we don't need to check the partial execution flags for its invocation.
-		        policyRuleEnforcer.execute(context);
+		        // to mimic operation of the original enforcer hook, we execute the following only in the initial state
+		        if (context.getState() == ModelState.INITIAL) {
+			        // If partial execution for focus policy rules and for assignments is turned off, this method call is a no-op.
+			        // So we don't need to check the partial execution flags for its invocation.
+			        policyRuleEnforcer.execute(context);
+		        }
 
 		        // Processing done, check for success