Enforce deny rules with unanalyzable commands

CHANGELOG · original

Fixed a case where a Read or Edit deny rule did not apply when an env -C, eval or similar command the permission checker cannot analyze was on the same line