cmake: ensure consumers do not overwrite the required policy