Truncate read acls after a DENY all on SQL Server

The read acls are materialized in the aclr table, we should truncate them as soon as there is a deny all (Deny Everyone)

So aclr like:
members,group,user,-Everyone,members,junk
is reduced to:
members,group,user,-Everyone

This has already been done on PG.