runsql: be consistent with preprocessing for check

Trimming every line is annoying but shouldn't hurt anything, and should
let us match play more closely.
Fix volume_access_check

Having direct take precedence over inherit was incoherent.  Only actual
immediate grants take precedence now, followed by max(everything else).