Protect all alias variants.

[morenstrat]

The @prod alias from drush/sites/self.site.yml can also be accessed by @site.prod. So maybe that alias should also be added to the template policy commands.