deny_by_default inverts permission rules

When I set `deny_by_default` to true, zf-mvc-auth seems to invert the meaning of my permission rules:

`module.config.php`:
```php
    'zf-mvc-auth' => array(
        'authorization' => array(
            'deny_by_default' => true,
            'Api\\V1\\Rest\\User\\Controller' => array(
                'entity' => array(
                    'GET' => true, // Don't need authorization?
                    'POST' => false,
                    'PATCH' => false,
                    'PUT' => false,
                    'DELETE' => false,
                ),
            ),
```

According to the documentation, the boolean value of GET determines whether or not authorization is required. However, when `deny_by_default` is `true`, suddenly the booleans are interpreted to mean that authorization is *not* required.

The documentation says that `deny_by_default` only changes behavior for actions for which no permission was defined, but in fact it inverts the existing permissions.

https://apigility.org/documentation/modules/zf-mvc-auth