narrow: fix narrow acl exclusion enforcement
Previously, it was possible for the user to remove excluded paths from their narrowspec that were added by server-side ACLs, meaning that ACLs could only be reliably enforced using includes rather than excludes. This change makes it an error to remove an ACL-specified exclude, much like how it is not possible to add a non-ACL-specified include.