Barrier should be able to deny certain XCMs from happening explicitly

[gilescope]

We currently have a set of allow rules that will let certain messages through using the ShouldExecute tuple.

The suggestion is to have a guard that ensures that any matching message is denied:

pub struct DenyThenTry<Deny, Allow>(PhantomData<Deny>, PhantomData<Allow>)
where
	Deny: ShouldExecute,
	Allow: ShouldExecute;

impl<Deny, Allow> ShouldExecute for DenyThenTry<Deny, Allow>
where
	Deny: ShouldExecute,
	Allow: ShouldExecute,
{
	fn should_execute<Call>(
		origin: &MultiLocation,
		message: &mut Xcm<Call>,
		max_weight: Weight,
		weight_credit: &mut Weight,
	) -> Result<(), ()> {
		Deny::should_execute(origin, message, max_weight, weight_credit)?;
		Allow::should_execute(origin, message, max_weight, weight_credit)
	}
}

At the moment DenyThenTry<(),(.....)> would always deny with the empty tuple because it returns Err() on nothing matched.

Keith mentioned that returning NoRulesMatched from RejectReason that paritytech/polkadot#5035 is introducing might help. It might be clearer if we had an opposite of the ShouldExecute trait.

[gilescope]

Supporting a mechanism of this ilk should mean that we can delete code introduced in cumulus PR: paritytech/cumulus#1169