The policy, described in the wake of the “Heartbleed” bug, carved out a broad exception for “a clear national security or law enforcement need,” administration officials said.