Refine AccessPolicy API

[danielballan]

Tersely capturing a design discussion with @nmaytan (to elaborate later)...

The AccessPolicy API may be extended from

def filter(self, node, principal, scopes)
    ...

def allowed_scopes(self, node, principal):
    ...

to

async def filter(self, node, principal, scopes, segments=None)
    ...

async def allowed_scopes(self, node, principal, segments=None):
    ...

Then the enforcement code in the server will identify the first node in the tree that has a not-None access_policy, and it will pass that node into filter along with the list of segments (i.e. URL path given as list of strings). Within filter, the access policy can do any additional I/O that it wants in order to decide the access allowed on the target.