Function record_denied 

fn record_denied<T>(
    cache: &CapabilityCache,
    profile_id: &ProfileId,
    bucket_id: &BucketId,
    iam_action: &str,
    result: &Result<SectionResult<T>, AppError>,
)

Record a Denied capability into the cache when the section is Denied.