New deny rules functionality: Added support for "always deny" rules alongside the existing "always allow" rules. This provides a more comprehensive permission model where certain tools can be permanently blocked.
Rule source tracking: Permission rules now track their source (e.g., "projectSettings", "localSettings") and behavior type ("allow" or "deny"), making it easier to understand why a tool is allowed or denied.
