ListAccess: Fix incorrect behavior when group appears twice for same rule

Later versions docs [1] have been updated to say that only a single rule
is picked and that it is the first rule. That description matches the
implementation for ACL evaluation in this version, but the REST API
'/access/?project=<project>' returns the wrong value.

[1] https://gerrit-review.googlesource.com/Documentation/access-control.html#_deny

Change-Id: Ia20714cc8445b1f2d0c895fdc51ab72dc7ea0895
Bug: Issue 14963
1 file changed