Support Organizations OU hierarchy for SCPs

[dnmfarrell]

#9 as written implies a single SCP applying like a boundary policy. In real AWS Organizations, SCPs apply through an OU tree — an account can have multiple SCPs in effect at once (attached directly to the account and inherited from each ancestor OU up to the root), and the effective permission set is the intersection of all of them.

Only matters if we want SCP fidelity beyond "single boundary-like policy" — worth deciding scope relative to #9.

Sub-tasks:

• Model an OU tree (or a simplified list of SCPs in effect for an account) rather than a single SCP.
• Evaluate the effective SCP permission set as the intersection across all applicable SCPs.
• Depends on Support Service Control Policies #9 landing first.