Feature: CIB: treat misconfigured rule as not passing

Previously, a rule with a missing id or invalid boolean-op would have that
part ignored, but the rest of the rule would continue to be evaluated. Now, it
is treated as a configuration error, and the rule fails.

Also, an "or" rule with no conditions is now properly treated as passing.