When both Allow and Deny cropping leases are applied, Deny should win…

## Short description
…instead Allow wins, which is not safe.

## Steps to reproduce
Ask someone to apply two active cropping leases: Allow and Deny. Try cropping image yourslef while not having edit_metadata permission. Cropping should be disabled.

## Actual results
Cropping is allowed.

## Expected results
Cropping should be denied.

## OS and browser details
All.

Start by reproducing the case with simultaneous Allow and Deny cropping leases and without edit_metadata permission, then locate the cropping authorization logic that combines those leases. Done means the same user cannot crop when both leases are active and the behavior is covered by a regression test.

Written by the indexing model from the issue text.