toCondition
Converts one principal tag into a nested query condition.
A wildcard requires only that the key exists. Other values match when the key is absent or its value is in the principal tag value set.
Return
the nested query condition
Combines all principal tags with AND semantics.
Return
the combined tag condition