Detect ambiguous rules at compile time

[charithe]

For example, given the following policy:

---
apiVersion: cerbos.dev/v1
resourcePolicy:
  version: "20210210"
  resource: leave_request
  rules:
  - action: approve
    derivedRoles:
    - direct_manager
    condition:
      match:
        expr:
        - request.resource.attr.status == "PENDING_APPROVAL"
    effect: EFFECT_ALLOW

  - action: approve
    derivedRoles:
    - employee_that_owns_the_record
    condition:
      match:
        expr:
        - request.resource.attr.status == "PENDING_APPROVAL"
    effect: EFFECT_DENY

A request like the following would match both rules and fail.

{
  "requestId": "460d1429-9798-4a6f-8505-170193909003",
  "principal": {
    "id": "maggie",
    "version": "20210210",
    "roles": [
      "employee",
      "manager"
    ],
    "attr": {
      "department": "marketing",
      "geography": "GB",
      "managed_geographies": "GB",
      "team": "design"
    }
  },
  "action": "approve",
  "resource": {
    "name": "leave_request",
    "version": "20210210",
    "attr": {
      "department": "marketing",
      "geography": "GB",
      "id": "XX125",
      "owner": "maggie",
      "status": "PENDING_APPROVAL",
      "team": "design"
    }
  }
}