* added test and some additional support for deny permissions w/ burnettk
* added support for deny through permissions-check api w/ burnettk
* support DENY at the beginning of a permission target marcro
* do not look up permissions using grant type, only use the uniqueness key
* added support in frontend to display a nice error if user does not have access to a data object value w/ burnettk
---------
Co-authored-by: jasquat <jasquat@users.noreply.github.com>