Add a default ACL deny-rule to reject subscription to `+/#` topic.
Since EMQX by default rejects subscription to `#` topic, for completeness, it should reject `+/#` as well.