feat(gate)!: new policy spec

[michael-0acf4]

Migration notes

• Replaced true, false, and null to ALLOW, DENY and PASS.

Composition rules:

1. On traversal order:

• ALLOW: allow parent and all its children (ignore inner policies)
• DENY: deny parent and all its children (ignore inner policies)
• PASS: pass through parent and evaluate each children (no-op, equivalent to no policies)

2. On a single type (a.with_policy(X).with_policy(Y)):

ALLOW and DENY compose the same as true and false with the AND gate, PASS does not participate.

• ALLOW & P = P
• DENY & P = DENY (e.g. DENY & ALLOW = DENY)
• PASS & P = P (does not participate)

• The change comes with new or modified tests
• Hard-to-understand functions have explanatory comments
• End-user documentation is updated to reflect the change