Add an ability to override ES index from a cluster scope

[kayrus]

Using the following policy it should be possible to override index IDs from a cluster (system) scope:

{
  "project_scope": "project_id:%(project_id)s",
  "domain_scope": "domain_id:%(domain_id)s",

  "cluster_viewer": "project_domain_name:cloud_domain and project_name:cloud_admin_project",
  "domain_viewer":  "rule:domain_scope and role:audit_viewer",
  "project_viewer": "rule:project_scope and role:audit_viewer",
  
  "event:list":     "rule:project_viewer or rule:domain_viewer or rule:cluster_viewer",
  "event:show":     "rule:project_viewer or rule:domain_viewer or rule:cluster_viewer"
}

Therefore a hermes client can list events in the whole region:

$ hermescli list -d --initiator-name user_name  --project-id '*'

Resolves #50

[coveralls]

Coverage remained the same at 0.0% when pulling 607a58c on kayrus:advanced-policy-rules into 6255908 on sapcc:master.

[coveralls]

Coverage remained the same at 0.0% when pulling 16fbb48 on kayrus:advanced-policy-rules into 6255908 on sapcc:master.