bucketpolicy: Improve bucket policy validation, avoid nested rules.

Bucket policy validation is more stricter now, to avoid nested
rules. The reason to do this is keep the rules simpler and more
meaningful avoiding conflicts.

This patch implements stricter checks.

Example policy to be generally avoided.
```
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Action": [
				"s3:GetObject",
				"s3:DeleteObject"
			],
			"Effect": "Allow",
			"Principal": {
				"AWS": [
					"*"
				]
			},
			"Resource": [
				"arn:aws:s3:::jarjarbing/*"
			]
		},
		{
			"Action": [
				"s3:GetObject",
				"s3:DeleteObject"
			],
			"Effect": "Deny",
			"Principal": {
				"AWS": [
					"*"
				]
			},
			"Resource": [
				"arn:aws:s3:::jarjarbing/restic/key/*"
			]
		}
	]
}
```

Bucket-Policy.md

@@ -0,0 +1,33 @@
+## Access Policy
+
+This package implements parsing and validating bucket access policies based on Access Policy Language specification - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html
+
+### Supports following effects.
+
+    Allow
+    Deny
+
+### Supports following set of operations.
+
+    s3:GetObject
+    s3:ListBucket
+    s3:PutObject
+    s3:GetBucketLocation
+    s3:DeleteObject
+    s3:AbortMultipartUpload
+    s3:ListBucketMultipartUploads
+    s3:ListMultipartUploadParts
+
+### Supports following conditions.
+
+    StringEquals
+    StringNotEquals
+
+Supported applicable condition keys for each conditions.
+
+    s3:prefix
+    s3:max-keys
+
+### Nested policy support.
+
+Nested policies are not allowed.