Add a rule that refuses or limits what may be written to the store.

deny refuses a matching write with the rule's name as the reason. clamp limits one number (bound): where a proposal can still be adjusted it is bounded, and at the last gate a write past the bound is refused. A rule naming a fact that is missing on a write refuses it: an unknown value is never read as "the condition does not hold". An allow rule is 403: it loosens, and only a person in the dashboard writes one. A rule that cannot bind is 400 invalid_rule. At most 100 rules per store.