Add policy for provisioning cisagov/cyhy-tf-root

[dav3r]

🗣 Description

This PR adds a policy that allows the provisioning of the resources in cisagov/cyhy-tf-root.

💭 Motivation and context

Without this policy, we won't be able to apply the Terraform in cisagov/cyhy-tf-root.

🧪 Testing

After I created this policy, I verified that I was able to successfully terraform apply and terraform destroy all of the resources for cisagov/cyhy-tf-root#12.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated
  to reflect the changes in this PR.
• All new and existing tests pass.