added a unit test to verify that merge of a denied privilege with an ACE that already contains a grant privilege works correctly