BoltAuth supports storing the indented policy now, so use that in
order to avoid re-parsing the policy string from the dbus call.
NB: the policy must not be DEFAULT, which handle_enroll_device
ensures by adjusting the policy if it is DEFAULT.