[xacml] Restricting MatchId

[Polar Humenn <polar@syr.edu>]

I cannot remember if we agreed to restrict the MatchId attribute only to

<type>-equal
regexp-string-match
rfc822Name-match
x500Name-match

And this restriction is for Subject, Resource, Action match in the Target,
but SubjectMatch in the <SubjectAttributeDesignator> may take other
functions.

Was this agreed upon?

-Polar