authz: Return DENY decision instead of throwing error when encountering attribute that doesn't exist

[elizabethhealy]

Right now in getDecisions, if we encounter an attribute that does not exist, we just return the error that we get from GetAttributeVluesByFqns.
Instead we should catch that specific error and return a deny decision.

[pflynn-virtru]

KAS is enforcing the attribute rules from a trusted attribute authority (not to mention entitlement authority).
The attribute authority has a set of namespaces.

If an attribute namespace is in the system and the attribute name or value is not then DENY.
If an attribute namespace is not in the system then IGNORE

Also, if the attribute format is not the TDF URL format then IGNORE

[elizabethhealy]

^ might need some more informant errors from the attributes service if we do this. rn we call getAttrValueByFqn and i believe it just returns "not found" if that fqn doesnt exist. we might need some more detail around whether its the namespace, attribute, or value that doesnt exist

[jakedoublev]

^ might need some more informant errors from the attributes service if we do this. rn we call getAttrValueByFqn and i believe it just returns "not found" if that fqn doesnt exist. we might need some more detail around whether its the namespace, attribute, or value that doesnt exist

I also encountered an unexpected behavior today where we return an error from GetAttributesByValueFqns if a single fqn is not found. I'm thinking this should be updated to log and ignore that single nonexistent fqn in the response without erroring in the entire request. @elizabethhealy @pflynn-virtru does that align with your thinking?