Apply a rule template to a rule scope

Copies the template's items into a rule scope as ordinary rules: enabled, with the polarity the mode implies. machine is a machine public_id, or empty for the caller's global rules. An item is skipped when an identical rule (same source, event_pattern, mode and sanitize_scope) is already in the scope, when it repeats an earlier item of the same template, and when it is a Raise rule (mode 3) and the caller lacks the raise grant or the item carries a sanitize_scope other than any. Every skip is counted in the response. 404 if the template is not visible to the caller. Cookie callers must pass CSRF.

This is a write: a read-only API key is refused with 403.