Ontology: Using `Policy` for `PolicyDocument`

[lebogg]

In #309 we introduced policies as sub classes of Policy. But Policy was originally meant to be something like Azure Policies I think.
Is it still the right place? @anatheka and me think functionality may be more appropriate. For me it is not a "functionality" but it is no security feature either. So functionality it is the best fit if we don't want it to be a policy like now