authz: add onPolicyUpdate callback to authz file watcher (#9142)

Small additional capability, so user code can tell when a new policy has
been loaded.

Our current usecase is updating an opentelemetry metric to reflect the
policy version (~= file mtime). We could just run a goroutine polling
the file separately, but then there's no guarantee that the authz policy
has actually been loaded - it could have failed parsing, or the process
could be CPU-starved, etc.

RELEASE NOTES:
* TBD