Add recursive deny to allowlists.

Also change behavior of the recursive check - the more specific
directory will be chosen now, for competing recursives.

This is part of an effort to enable mixed_libc and mixed_droid on
internal master - many denies are required and this would simplify the
effort.
Test: m nothing

Change-Id: I7de05337644d8e1804078c66669dd0b2d65f3e71