Function deny_paths 

pub fn deny_paths(
    graph: &Graph,
    name: &str,
    allowed: &HashSet<EdgeKind>,
) -> Option<Violation>

Evaluate --deny NAME: a violation when name resolves anywhere reachable from the workspace members over allowed edges.