Fix deprecated matcher method on DenyAccessMatcher

`DenyAccessMatcher` used `#negative_failure_message`, which has been
deprecated in favor of the newer RSpec matcher method
`#failure_message_when_negated`. Renamed this instance variable and the
`attr_reader` to remove RSpec 3.0 deprecation warnings when using
`DenyAccessMatcher` in specs.

Added aliases `failure_message_for_should` and
`failure_message_for_should_not` to maintain RSpec 1.2+, < 3.0 compatibility.
Prefer double-quoted strings unless you need single quotes to avoid extra backslashes for escaping.