### Check for existing issues

- [X] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

The dashboard's "Specific" policy attachment scope can submit an attachment with no teams, keys, models, or tags. The backend's `PolicyScope.get_teams/get_keys/get_models` helpers default missing or empty selectors to `["*"]`, and `PolicyMatcher.scope_matches` treats `["*"]` as "match anything". The result is that a policy the operator believed was scoped to specific resources actually applies to every request.

**Observed:** `build_attachment_data` omits selector fields when their arrays are empty, sending only `{policy_name}`. `PolicyAttachment.to_policy_scope` produces a `PolicyScope` with no selectors. `PolicyScope.get_teams/get_keys/get_models` substitute `["*"]` when values are missing, and `scope_matches` treats `*` as a wildcard. The attachment matches every team, every key, and every model — the same behavior the operator would have gotten by explicitly choosing "Global".

**Expected:** A "Specific" attachment with no selectors should either be rejected at submit time or stored in a way that matches nothing (i.e., the empty intersectio…