README: Add a few words about the deny-all policy engine