Support the concept of Policy constraints

**What**

While overrides and defaults provide valuable ways for different personas to collaborate on different policies that form a single effective policy, there is a weakness in this concept. Overrides and defaults do not allow a persona working higher in the hierarchy to pick a set of boundaries and rules within which someone can override a default from lower in the hierarchy.

Use Case:

As a gateway admin I have set a generic limit of x requests per remote IP per minute across all endpoints as a default to ensure there is some level of protection for endpoints exposed via the targeted gateway. I understand that the development teams may need to override this limit and potentially increase it for a given end point. I want to allow them to do so, but within a particular set of constraints IE they can override my limit for their endpoint up y requests per IP per minute but not beyond that.

As a gateway admin, I have set a default DENY all auth policy at the gateway. I want development teams to override this for their endpoints but only if they use the company SSO server. I don't want to allow them simply to set an override that allows all or allows API key access

The issue provides no files, tests, or entry points; start by locating the existing policy defaults and overrides model in the Go operator. Define the constraint behavior against the two stated gateway use cases, then add coverage demonstrating bounded rate-limit and authentication overrides.

Written by the indexing model from the issue text.