Add option to pull Forseti policy bundle

[gkowalski-google]

Story

To support enabling CV by default and migrating some Forseti scanner functionality to CV, provide a default set of policies to match the default rules deployed with Forseti:

• BigQuery
• CloudSQL
• Firewall
• IAM
• KMS
• Service Account Key

Proposed Solution

• Add a new variable to enable/disable the policy bundle
• Add a new variable to control the policy bundle (e.g. default to forseti bundle)
• Add a new variable to control the policy bundle gcs sync (default to enabled)
• Update install_simple example to use the bundle

Acceptance Criteria

• Add test to ensure the bundle is pulled and there are constraints

[gkowalski-google]

Changes have been pushed to feature branch where this change is almost complete, along with tests. Just need to wait for kpt release and then uncomment the lines to run the kpt setters.