fix: mask out rule permissions before merging permissions

Signed-off-by: Robin Appelman <robin@icewind.nl>

lib/ACL/Rule.php

@@ -145,7 +145,7 @@ public static function mergeRules(array $rules): Rule {
 		}, 0);
 		// or'ing the permissions combines them with allow overwriting deny
 		$permissions = array_reduce($rules, function (int $permissions, Rule $rule) {
-			return $permissions | $rule->getPermissions();
+			return $permissions | ($rule->getPermissions() & $rule->getMask());
 		}, 0);
 
 		return new Rule(