policy: Allow duplicate statements with different effects (#8775)

This allows "Allow" and "Deny" conflicting statements,
where we evaluate to implicit "Deny".

pkg/iam/policy/policy.go

@@ -106,6 +106,10 @@ func (iamp Policy) isValid() error {
 
 	for i := range iamp.Statements {
 		for _, statement := range iamp.Statements[i+1:] {
+			if iamp.Statements[i].Effect != statement.Effect {
+				continue
+			}
+
 			actions := iamp.Statements[i].Actions.Intersection(statement.Actions)
 			if len(actions) == 0 {
 				continue