Deny policy doesn't work for non-transitive repo

[kriswuollett]

The following config file does not stop any of the google/protobuf/util/*.proto files with protofetch 0.1.11 from being copied into the protos/ directory:

name = "protofetch-simple"
description = "Simply fetch protos with filter"
proto_out_dir = "protos"

[protobuf]
url = "github.com/protocolbuffers/protobuf"
protocol = "https"
revision = "88e11bd819938bfc3f8a4b09495774b8d2d50cd3"
content_roots = ["src"]
allow_policies = ["google/protobuf/*"]
deny_policies = [
  "google/protobuf/util/*",
  "src/google/protobuf/util/*",
  "protos/google/protobuf/util/*",
]

May be related to #139? It also isn't clear what the application order would be. I'd assume allow then deny? Docs doesn't mention that or from where the paths are calculated from specifically.