Added test for #3454.
Fix #3454.

The fix involves forcing a loop through the parent resources when the
current resource is 'TYPE_DENIED'. The loop stops when we are already at
the top-level resource.
Ensure privilege escalation is not possible.

With the previous version, a deny() on a lower-lever resource was not
inherited when on a higher-lever resource an allow() was given.

See the updated test for more an example.
Ensure all children inherit permissions.
Merge branch 'hotfix/3479'

Close #3479
Fixes #3454