Add a "Deny" permission, or allow us to "un-inherit" permissions in Control security roles

It is currently not possible to un-inherit permissions in security roles. This means if you want to deny access to one client, you have to manually allow access to all other clients instead. Terrible design, please fix.