Default deny qubes-rpc policies for sd-gpg and sd-svs

[emkll]

Qubes rpc policies have an 'ask' default policy:
$anyvm $anyvm ask

This means that an action with no explicit authorization will present a user with the following message:

This popup screen requesting authorization might confuse a user and might result in a file being copied, decrypted, or executed, due to user error.

For the VMs used in the context of the SecureDrop Workstation, we should ensure that the default policies for qubes-rpc commands are set to deny other vms. Specifically, qubes.Filecopy, qubes.Gpg, qubes.Openinvm, as well as any other policies that are not required for the functionality.

[kushaldas]

👍 to this feature. Sometimes it is difficult to figure out which process is asking the permission, so default deny is a better option.

Btw, @emkll who took that screenshot? Looks nice 😆