Let Policies declare to be applicable only for certain namespaces

[thjaeckle]

Define that a policy entry is only applicable for entities within a certain or several certain namespaces.

This feature is especially useful when used in combination with policy imports and eg defining in a "root policy" that the policy shall only be applied for a certain namespace.

This should also be applicable to the search index.

Example use case:

• assume a root policy is defined which shall be imported by all other policies definining an entry which shall be implicitly applied
• however, the entry should only be applied for special groups of things, e.g. for the group of all devices, but not the group of all rooms or buildings (also modeled as things)
• in such a case, defining special namespaces for the different groups would make sense and with the added feature in the policy it could be enforced

When using the namespace as kind of tenant name for a multi tenant system, such a namespaces scoping would even improve tenant isolation.