Adjust and simplify policy operator combinations

[vdzhuvinov]

Addresses issues #11 , #129 , #180.

The chief aim of this PR is to make it easier for architects to devise metadata policies in federations with multiple Trust Anchors or federations with complex topologies. In a single-anchored federation the current, limited operator combinations were okay, because one can simply lookup the policies of the Superior(s) and tweak the local policy where necessary. When dealing with multiple Trust Anchors the limited combinations become a problem. This PR fixes that. It also fixes the value + essential combination, which current spec may lead to policy conflict (#180).

This PR incorporates the contributions of @zachmann from PRs #111 and #112 (thanks!), with slight edits , plus several additional combination changes.

The proposed combinations were implemented in the Nimbus OIDC / OAuth SDK and were tested, including tests against a suite of several thousand generated test vectors: https://connect2id.com/blog/metadata-policy-test-vectors-openid-federation

The proposed combinations changes + fix, as a table:

The combinations in draft 41, for comparison. Notice that the updated version has more green or yellow squares for policies to "land", as it covers all logical combinations.

This PR also tightens the language in a few places.

[zachmann]

There is an error in the image: The "new" table states the check for value + add is The value of "value" MUST be a subset of the values "add". It should be the other way round: The value of "add" MUST be a subset of the values of "value".

The spec text is fine.

[vdzhuvinov]

The "new" table states the check for value + add is The value of "value" MUST be a subset of the values "add". It should be the other way round: The value of "add" MUST be a subset of the values of "value".

@zachmann Thanks for spotting this, I fixed the table.

[vdzhuvinov]

Please, ignore this PR for the time being. I had a chat with Roland and we also want to investigate an alternative change where in combinations of the value operator it always takes precedence.

[rohe]

For value+superset_of in the Combination checks table, the text should be:
The values of "value" MUST be a superset of the values of "superset_of".
not
The values of "default" MUST be a superset of the values of "superset_of".

[vdzhuvinov]

@rohe Fixed the table to mark the add + superset_of combination as unconditional (green).

[vdzhuvinov]

For value+superset_of in the Combination checks table, the text should be: The values of "value" MUST be a superset of the values of "superset_of". not The values of "default" MUST be a superset of the values of "superset_of".

@rohe Fixed that table cell too, thanks!

[selfissued]

There are test vectors for this at https://connect2id.com/blog/metadata-policy-test-vectors-openid-federation