v2.1.289: Nested deny/ask rules hold on managed machines

Deny or ask rules on nested parts of a compound shell command now hold on managed machines.