#1638 add support for namespace root policies

[hu-ahmed]

Resolves: #1638

Summary

This PR adds support for namespace root policies in Ditto policy enforcement.

A namespace can be mapped to one or more root policy IDs. During enforcer creation, Ditto transparently merges entries from those root policies into policies of that namespace.

What changed

• Added namespace-root merge support in policy enforcer resolution.
• Added config abstraction:
  • NamespacePoliciesConfig
  • DefaultNamespacePoliciesConfig
• Wired namespace policy resolution into:
  • cache loader path
  • create-policy enforcement path (PolicyEnforcerActor)
• Extended cache invalidation:
  • when a namespace root policy changes, cached policies in covered namespaces are invalidated.
• Added canonical base config file:
  • internal/utils/config/.../ditto-namespace-policies.conf
  • included via ditto-service-base.conf
• Updated Helm templates and values to service-scoped config (entity-creation style):
  • policies.config.namespacePolicies
  • things.config.namespacePolicies
• Updated chart docs accordingly.

Behavior / rules

• Only entries with importable = "implicit" are merged.
• Entries with importable = "explicit" or importable = "never" are not merged.
• Local policy entries win on label conflicts.
• If a configured root policy is missing/deleted, entries are skipped and an ERROR is logged.
• Stored policy JSON is not modified; merge happens at enforcer-build time.

Example config

policies:
  config:
    namespacePolicies:
      org.example.devices:
        - org.example:tenant-root

things:
  config:
    namespacePolicies:
      org.example.devices:
        - org.example:tenant-root