Checked whether an automated test already existed for this manual test: there was none. No testwikis fixture had any document-level rule targeting the comment right, and no functional test asserts that a user denied the comment right on a page can't comment it.
Added the test at the authorization-engine level rather than as a functional test, as was done for XWIKI-24701. The expected result of the manual test — "the user (U1) is not allowed to comment on that page" — is pure authorization semantics, and the engine level lets the assertions the manual test implies but doesn't state all be covered in a few milliseconds instead of a few minutes of browser time: the comment right is gone on that document, the user's other rights survive, and a user the rule is not targeting keeps the comment right. The rights-editor UI path the manual test describes is already exercised by UsersGroupsRightsManagementIT.
The test also pins a point that isn't obvious from the manual test: the user keeps the edit right on that page, and the edit right does not give the comment right back — Right.EDIT is declared implying Right.VIEW only.
Test added: DefaultAuthorizationManagerIntegrationTest#userDenyCommentAtDocumentLevel, with a new testwikis/userDenyCommentAtDocumentLevel.xml fixture — a wiki without any rule, and a document carrying a single denyUser type="comment" rule for userA. The contrast with userB, which keeps the comment right on that same document, is what keeps the assertion from being vacuous.
