Track denied source identifiers during policy evaluation and flag the policy progress vertex as failed when BuildKit returns a matching DENY error pattern. This improves the progress output of policy error and shows last policy logs with the build error. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>