Support for using wildcard in place of feature name in policies

[thjaeckle]

As an enhancement of #696 it should be possible to define in a policy that all features of a single thing are addressed in the resources section of the policy.
Therefore it should not be required to write all feature names in the policy as sharing policies for many things would also be very limited by this approach.

• using the wildcard * as part of this story is only supported as replacement for the feature name
• it shall be possible to use the wildcard for following resource types:
  • thing: thing:/features/*/properties
  • message (which was already requested by another issue: Support for policy wildcard in message:/features #685 - the other issue will be closed as duplicate): message:/features/*/inbox
• the

Example policy:

{
    "policyId": "org.eclipse.ditto:policy-1",
    "entries": {
      "owner": {
        "subjects": {
          "nginx:ditto": {
            "type": "nginx basic auth user"
          }
        },
        "resources": {
          "thing:/features/*/properties": {
            "grant": ["READ"],
            "revoke": []
          },
          "thing:/features/*/desiredProperties": {
            "grant": ["READ","WRITE"],
            "revoke": []
          },
          "message:/features/*/inbox": {
            "grant": ["WRITE"],
            "revoke": []
          },
          "message:/features/*/outbox": {
            "grant": ["READ"],
            "revoke": []
          },
          "policy:/": {
            "grant": ["READ", "WRITE"],
            "revoke": []
          }
        }
      },
      "device": {
        "subjects": {
          "pre-authenticated:hono": {
            "type": "connection to Hono"
          }
        },
        "resources": {
          "thing:/features/*/properties": {
            "grant": ["READ","WRITE"],
            "revoke": []
          },
          "thing:/features/*/desiredProperties": {
            "grant": ["READ"],
            "revoke": []
          },
          "message:/features/*/inbox": {
            "grant": ["READ"],
            "revoke": []
          },
          "message:/features/*/outbox": {
            "grant": ["WRITE"],
            "revoke": []
          }
        }
      },
      "all_features_reader": {
        "subjects": {
          "nginx:some-users": {
            "type": "a group of users"
          },
          "resources": {
            "thing:/features/*": {
              "grant": ["READ"],
              "revoke": []
            }
          }
        }
      }
    }
  }

[thjaeckle]

I am getting interested in this again - would be very useful for e.g. defining "end user" "WRITE" permission to all "desiredProperties", but only "READ" to all "properties".