Enrich built-in policies with the deny effect

[RoboK8]

Hello,

We're currently working on PaaS resources baselines, and if you want to enforce many built-in policies you need to duplicate the built-in policy into a custom one just to add the "Deny" effect.

If most policies regarding PaaS (or IaaS) configurations could have by default the "deny" option on top of "Audit", "Disabled" it would save a lot of work for many people while not being a change for anyone who doesn't need/want it.

Regards,

Kate