Implement policy owner logic

[rtisma]

Currently, the policy owneer field is unused.

The idea is that if a user creates a policy, they are the owner of that policy, and only they can write (i.e create, update and delete) to that policy. Anyone can read a the policy.

Group or user permissions associated with a policy can only be controlled by the policy owner, however all permissions can be read by any user.

[alekspejovic]

This is a use case for ARGO.