We've been actually assuming ACLs were working this way in all our
configuration files, so better make it so: the first path match in the
ACL allow list will cause the list iteration to stop (the final result
will then depend on the CN match).