Alert and create a status when a child account isn't healthy

[kddejong]

Certain configurations could result in a child account becoming not healthy. Can't use the trust, etc. We want to move accounts that run into that issue into not being healthy and alert appropriately.

[eschwartz]

Just ran into a couple "unhealthy" accounts, so I'll get started with a list of things we could check:

• AdminRole exists and is assumable by master
• PrincipalRole exists and is assumable by master
• PrincipalPolicy exists
• PrincipalPolicy matches hash in DB
• PrincipalPolicy is attached to the PrincipalRole