device_cgroup: rename deny_all to behavior