Break policy engine plugins out into separate repos

Currently all policy engine plugins (_opa, themis_) are in the same repo.

I think it makes better sense to break these out into their own repositories.
The main driver being that it would keep the go module mgmt separate between policy engines.
Since policy is already an external plugin, this does not add significantly more work to users of policy engines.

I'm proposing to ...
* Break opa and themis out into separate repos.
* Move the firewall plugin into the root of the policy repo.
* Consider renaming the plugin "policy" or renaming the repo "firewall" so the repo and the plugin name match.

This is disruptive. The changes would impact current users of the _firewall_ plugin, requiring updating paths in `plugin.cfg`.

Start by mapping the current opa, themis, and firewall plugin layout and checking how plugin.cfg references the firewall plugin. Then assess the proposed repository and Go module boundaries, including the naming alternatives. Done means the repository split, firewall relocation, naming decision, and required plugin.cfg path changes are specified clearly enough to implement.

Written by the indexing model from the issue text.