Support path overrides

Given a denied path, `/posts`, currently the following would all be denied:

- ❌ `/posts`
- ❌ `/posts/new`
- ❌ `/posts/1`

It would be nice to be able to configure a path, say `/posts/new` to override the above:

- ❌ `/posts`
- ✅ `/posts/new`
- ❌ `/posts/1`

Start by locating the Rails middleware that evaluates denied request paths and read how path matching is currently handled. Define configuration for an allowed override such as /posts/new, while keeping /posts and /posts/1 denied; done means the three examples produce the requested results and the relevant middleware behavior is covered by tests.

Written by the indexing model from the issue text.