Adding a simulator + regopolicyinterpreter.

[matajoh]

This PR separates all the interaction with Rego into its own extractable package called regopolicyinterpreter. Instead of calling Rego directly, the securitypolicy package now uses this package to implement Rego policies. Separating out the Rego interpreter behavior in this way allows the same code to be used by a new policyenginesimulator tool, which provides the ability to simulate security policy execution on the command line.

regopolicyinterpreter exposes various Rego things like modules and metadata in a typed way to make them easier to work with:

• RegoPolicyInterpreter is the main interface
• RegoModule is a standalone Rego module that can be included in the policy execution. There are AddModule and RemoveModule methods for modifying the interpreter to include various modules.
• RegoQueryResult wraps the results that come from the Rego policy with some useful methods for extracting scalar data types (i.e. bool/int/float/string)
• EnableLogging provides a way to get multiple levels of policy logging for debugging purposes, ranging from Info, which will output prints that come from the Rego policy itself, to Metadata, which will dump the entire policy metadata structure to the log with each interaction. This is primarily intended for offline use (e.g. by the simulator).

The policyenginesimulator tool uses RegoPolicyInterpreter to simulate policy enforcement. Usage:

  -commands string
        commands JSON
  -data string
        initial data state
  -log string
        log path
  -logLevel string
        None|Info|Results|Metadata (default "Info")
  -policy string
        policy Rego

The commands JSON allows the user to specify the type and order of the commands send by the host to the guest that will interact with the simulated policy, for example:

[
    {
        "name": "load_fragment",
        "input": {
            "issuer": "did:web:contoso.github.io",
            "feed": "contoso.azurecr.io/custom",
            "namespace": "custom",
            "local_path": "custom.rego"
        }
    },
    {
        "name": "mount_device",
        "input": {
            "target": "/mnt/layer0",
            "deviceHash": "16b514057a06ad665f92c02863aca074fd5976c755d26bff16365299169e8415"
        }
    },
    {
        "name": "mount_overlay",
        "input": {
            "target": "/mnt/overlay0",
            "containerID": "container0",
            "layerPaths": [
                "/mnt/layer0"
            ]
        }
    },
    {
        "name": "create_container",
        "input": {
            "containerID": "container0",
            "argList": [
                "/pause"
            ],
            "envList": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "TERM=xterm"
            ],
            "mounts": [],
            "workingDir": "/",
            "sandboxDir": "/sandbox",
            "hugePagesDir": "/hugepages"
        }
    }
]

[anmaxvl]

why is this here? shouldn't this be part of rego enforcer?

[matajoh]

Since the policy simulator can run in either windows or Linux, and since it needs this string to simulate policies, it made sense to move it to securitypolicy.go, which is not boxed by a build tag.