DENY TO PUBLIC can't be REVOKE DENYed.

Brought by ramesh

DENY TO PUBLIC appears to be sticky, not easily revertable

A root user can do

DENY SELECT ON test.t1 TO PUBLIC;

REVOKE DENY SELECT ON test.t1 FROM PUBLIC;

in the same session, but if he reconnects between above statements. Root can't REVOKE DENY, because REVOKE (DENY) requires SELECT on test.t1, and this access was previously denied to everyone.

Currently, the situation is fixable with raw access to mysql.global_privs, and changing user's json, then FLIUSH PRIVILEGES. In a way it is fixable with REVOKE ALL ..., GRANT OPTION, or DELETE public from the mysql.global_privs table, alas those are quite an overshoot.

To fix that paradox situation, we'll allow REVOKE DENY FROM PUBLIC, if user has UPDATE on mysql.global_privs (i.e he can also fix by manually in mysql.global_privs)