Add aggregate semantics to Policy Compiler

[copybara-service]

Add aggregate semantics to Policy Compiler

Aggregate walks through all matching rules (including nested ones) and appends them into a list:

rule:
  semantics: aggregate
  match:
    - condition: "true"
      output: "'FOO'"
    - condition: "true"
      output: "'BAR'"

# Output: ['FOO','BAR']

Few noteworthy design decisions below. All examples assume all conditions matched:

1. For usability reasons, subrules under an aggregate ancestor will always have their lists flattened:

name: aggregate_flat_flattening_example
rule:
  semantics: aggregate
  match:
    - rule:
        semantics: first_match
        match:
          - condition: "resource.is_admin == true"
            rule:
              semantics: aggregate
              match:
                - condition: "resource.has_standard_pii == true"
                  output: "'GDPR_STANDARD'"    
                - condition: "resource.is_b2c == true"
                  output: "'EU_B2C_NOTICE'"     
    - condition: "true"
      output: "'FALLBACK'"

# Output: ['GDPR_STANDARD', 'EU_B2C_NOTICE', 'FALLBACK']

2. Base case of an aggregate rule is an empty list. Nested conditional rules within an aggregate rule which outputs optional.none() are pruned (except in cases where policy output explicitly emits an optional.none()):

name: optional_pruning_example
rule:
  semantics: aggregate
  match:
    - rule:
        semantics: first_match
        match:
          - condition: "1 == 2"
            output: "'EU_NOTICE'"
    - condition: "true"
      output: "'ALWAYS'"

# Output: ['ALWAYS']

name: explicit_optional_none_example
rule:
  semantics: aggregate
  match:
    - rule:
        semantics: first_match
        match:
          - condition: "resource.is_b2c == true"
            output: "optional.none()"   # Explicitly authored by user

    - condition: "true"
      output: "optional.of('ALWAYS')"

# Output: [optional.none(), optional.of('ALWAYS')]