fix(vendor): filterPermissions misses DenyGrant

The publicstorageprovider reduces child permissions to what the link grants,
field by field, but DenyGrant is not in the list: a child of a view-only link
could advertise deny. Same vendored-reva caveat as checkGraphDrivesPath, goes
into the reva PR later.

vendor/github.com/opencloud-eu/reva/v2/internal/grpc/services/publicstorageprovider/publicstorageprovider.go

@@ -871,6 +871,7 @@ func filterPermissions(l *provider.ResourcePermissions, r *provider.ResourcePerm
 	l.RestoreRecycleItem = l.RestoreRecycleItem && r.RestoreRecycleItem
 	l.Stat = l.Stat && r.Stat
 	l.UpdateGrant = l.UpdateGrant && r.UpdateGrant
+	l.DenyGrant = l.DenyGrant && r.DenyGrant
 }
 
 func (s *service) ListFileVersions(ctx context.Context, req *provider.ListFileVersionsRequest) (*provider.ListFileVersionsResponse, error) {