Low: ACLs: bail out early when creating element that'll be denied anyway

Previously, the logic was rather obtuse regarding the to-be-done
iterative work even at the time it was already known it makes no sense
to continue (as attested in the final "is the outcome from the work
we've just been doing legal, afterall?" retrospective later on).
The solution is to bail out early, which coincidentally sheds more
clarity to the respective cibadmin failure mode, since now, an
explanatory stanza is added (see regresion.acls.exp changes).

Origially authored by jnpkrn, minor edits by me.