libcli/security: fix handling of deny type ACEs in access_check_max_allowed()