Support for container policies

[jiparis]

Containers are a special case, since the material content is the manifest, which must be pulled before evaluating the policy. This feature will allow to create policies of type CONTAINER_IMAGE

spec:
  type: CONTAINER_IMAGE
  embedded: |
     package main
     ...