smack: don't terminate if rule pair is not found

In the case where a subject-object pair is not found in the hashmap,
bt-daemon should *deny* access, not terminate; this way, buxton handles
the last access check "law" correctly:

1. Check access for builtin rules
2. Check access for loaded rules
3. Else, deny access

We check in 1,3,2 order, but it is effectively the same due to way the
hashmap is used.