initial key management policy

[kdenhartog]

Summary

This defines an initial key management policy. It's mainly a copy over from https://github.com/brave-intl/bat-go/pull/1384/ with a few slight modifications. For now it's just the basics, but as we start to need new roles we can expand on this doc then.

Type of Change

• [ ] Product feature
• [ ] Bug fix
• [ ] Performance improvement
• [ ] Refactor
• [X] Other

Tested Environments

• [ ] Development
• [ ] Staging
• [ ] Production

Before Requesting Review

• [ ] Does your code build cleanly without any errors or warnings?
• [ ] Have you used auto closing keywords?
• [ ] Have you added tests for new functionality?
• [ ] Have validated query efficiency for new database queries?
• [ ] Have documented new functionality in README or in comments?
• [ ] Have you squashed all intermediate commits?
• [ ] Is there a clear title that explains what the PR does?
• [ ] Have you used intuitive function, variable and other naming?
• [ ] Have you requested security and/or privacy review if needed
• [ ] Have you performed a self review of this PR?

Manual Test Plan