Policy assignment exclusions and generated-policy editor styling

Exclude specific users from a policy assignment.
When publishing or updating a policy, admins can now exclude specific users from the assignment. This is useful when a policy applies broadly but has a handful of exceptions who shouldn't be asked to acknowledge it.

Admins and auditors can now re-include a user who was previously excluded from a policy assignment. Re-including a user also restores the assignment automatically for users who were removed because they lost the required role or seat.

Generated-policy editor now matches the published PDF.
Tables and headings in the generated-policy editor now render with the same styling used in the exported PDF, so what admins see while editing matches what employees see after publish.