server: bundle-owned policy could be renamed

[srenatus]

When a bundle owns a certain root, and contains policies, policies under that root could be replaced via the REST API because of a missing bundle scope check:

With a bundle manifest like

{ "roots": [ "x/y" ] }

and this policy in the bundle,

package x.y.z
foo := 1

we find:

$ curl "http://127.0.0.1:8181/v1/policies/%2fauthz%2fx%2fyz.rego"
{"result":{"id":"/authz/x/yz.rego","raw":"package x.y.z\n\nfoo := 1\n","ast":null}}
$ curl "http://127.0.0.1:8181/v1/data/x/y/z/foo"                 
{"result":1}
$ curl "http://127.0.0.1:8181/v1/policies/%2fauthz%2fx%2fyz.rego" -XDELETE
{
  "code": "invalid_parameter",
  "message": "path x/y/z is owned by bundle \"authz\""
}
$ curl "http://127.0.0.1:8181/v1/policies/%2fauthz%2fx%2fyz.rego" -XPUT --data-binary @y.rego
{}
$ curl "http://127.0.0.1:8181/v1/data/x/y/z/foo"                                             
{}
$ curl "http://127.0.0.1:8181/v1/data/a/b/foo"
{"result":2}
$

where y.rego is

package a.b
foo := 2

⚡ While the DELETE is properly protected, and PUT requests keeping the package path intact are, too; PUTs with a different target package path are processed as-is. We're missing a check here.