require templates in the `Template` constructors

Description of changes

The public-facing Template constructors will now return an error if passed a static policy.
The internal Template type will continue to support both templates and static policies. There are several places in the parser and validator where we want a single type to represent both options because we use the same logic for both. I added comments & did some renaming in places where I felt this was unclear.
Added new error variants to FromJsonError (PolicyToTemplate) and ParseError (ExpectedTemplate) to return in the case where a static policy is being used as a template.
Made corresponding changes to the FFI code and test cases.

Resolves #1095

The change in this PR is (choose one, and delete the other options):

[X] A breaking change requiring a major version bump to cedar-policy (e.g., changes to the signature of an existing API).

I confirm that this PR (choose one, and delete the other options):

[X] Updates the "Unreleased" section of the CHANGELOG with a description of my change (required for major/minor version bumps).

I confirm that cedar-spec (choose one, and delete the other options):

[X] Does not require updates because my change does not impact the Cedar formal model or DRT infrastructure.