Redirection checks prefer the strongest denial

When a command writes to several paths, the checker now collects every blocking result and returns one that cannot be waived by the permission classifier if there is one, instead of stopping at the first hit found. An older redirection and process-substitution checker was removed in the same change.