Add bucket map configuration for denying all access to a prefix

[reweeden]

This eliminates the need for a workaround using a dummy group like this:

SOME_PATH: my-bucket

PRIVATE_BUCKETS:
  my-bucket:
    - NOACCESS
  my-bucket/prefix1/:
    - NOACCESS
    - group_1
  my-bucket/prefix2/:
    - NOACCESS
    - group_2

The new bucket configuration would look like this:

SOME_PATH: my-bucket

PRIVATE_BUCKETS:
  my-bucket/prefix1/:
    - group_1
  my-bucket/prefix2/:
    - group_2
NOACCESS_BUCKETS:
  my-bucket: Deny access to the empty prefix

I'm open to an alternative name to NOACCESS_BUCKETS.