Policy Service APIs should use introduce a new group

• Allow operations related APIs to use a new group 'service.policy.ops' (but make it configurable).
• For backwards compatibility make it default to 'service.policy.admin'.

For the following APIs:

• GET, PUT, DELETE /api/policy/v1/tenant

Maybe also:

• GET /api/policy/v1/backup
• POST /api/policy/v1/bootstrap