Flesh out support for DenyGroups partition configuration parameter

The AllowGroups and DenyGroups configuration parameters only apply
to the effective group ID of the job. Previously any user with
access to any allowed group was permitted to use the partition.