Resource data mask policy overrides when both tag and resource datamask policies match

If both tag and resource data-mask policies match accessed hive resource, mask-specification in the resource policy is always used. The audit log record is inconsistent in that it contains tag-policy-id as determining data-mask policy, but the masking specification is from resource policy.