docs(access-rules): define FORMULA contexts for CREATE and UPDATE

[Martin187187]

Summary

This PR defines the data against which a FORMULA is evaluated for CREATE and UPDATE operations.

Changes

• Defines that CREATE evaluates the submitted representations of the objects to be created.
• Allows relevant existing parent or container objects to remain available to FieldIdentifier resolution during CREATE authorization.
• Defines that UPDATE evaluates the formula separately against the current state and the prospective resulting state.
• Requires both UPDATE evaluations to be true before the rule grants permission.
• Defines the prospective state using the normal semantics of the interface operation, including partial updates and replacements.
• Leaves the normative operation-to-RIGHT mapping unchanged, including SME POST operations requiring CREATE.

Validation

• python tools/validate_spec_artifacts.py
• python -m unittest discover -s tests/query

Closes #98

[Martin187187]

approved by Securtiy TF