Better document freestanding execution engine and policy format

[gbryant-arm]

Requested feature
It is not crystal clear that it's not possible to map individual files to the freestanding execution engine's VFS: only directories can be mapped, and every file under them gets recursively mapped.
Moreover, it is not obvious that the program should be mapped to the VFS as another input source (-i <program directory>).
The documentation should be updated.
Same goes for policies: you can't give permissions to specific files except for special files (services, std streams). This doesn't seem to be documented anywhere.

Motivation
Running the freestanding execution engine

[gbryant-arm]

Relates to #77