Rule: `impossible-not`

[anderseknert]

This is a mistake I see devs do every now and then — it just never struck me as something we could try and prevent.

deny contains something if {
    # ...
}

test_deny if {
    not deny with # ...
}

We should flag when not is used on anything but boolean rules / vars. This might not be possible to determine in all cases based on the AST alone, but for the cases where we can, we should.