Submit a policy for your own account

Stores a new version of the rules your account puts on itself, and validates it. The policy must declare package account.a_<your account id, dashes as underscores> and may only DENY: it is evaluated after platform and tenant policy, only for requests your account makes, and a deny there refuses what they allowed. allow and declared_types are refused, because an account cannot grant itself anything. Otherwise it is validated exactly like a tenant policy — restricted builtins, the enforcer.v1 stdlib, the policy's own test_ rules — and a refused submission is stored with its reason and still returns 200, with the verdict in validation. Nothing changes until a version is activated.