Function encode_deny 

pub fn encode_deny(
    explicit: bool,
    action: Option<&str>,
    principal_arn: Option<&str>,
    matched_statements: Vec<Value>,
    context: Option<Value>,
) -> String

Build an encoded authorization message describing a deny decision. The shape mirrors what AWS returns from DecodeAuthorizationMessage: an allowed flag, an explicitDeny flag, and a matchedStatements.items array. Optional supplementary keys (action, principal, context) are included so an operator inspecting the decoded blob can see why the request failed.