Multiple APDU filters shall be combined per OR operation

[ghost]

According to Secure Element Access Control specification, APDU filters
shall be combined per OR operation if multiple access rules contain the
different filters.

The APDU access is not changed from the initial value "UNDEFINED" if the
previous access rule has APDU filter, so new APDU filter shall be
combined unless the APDU access is already set to "DENIED".

[ghost]

The section 3.4.1 of Secure Element Access Control says;

If multiple access rules contain APDU filters, then these shall be combined per OR operation.

Actually putWithMerge() is implemented for that, but the condition is not good.

Please imagine that there are the following 2 access rules detected. Both APDU filters must work in this case.

- Access rule 1 contains an APDU filter A
- Access rule 2 contains an APDU filter B

ApduAccess is still not changed to ChannelAccess.ACCESS.ALLOWED right after processing the access rule 1, so the APDU filter B is not merged mistakenly when processing the access rule 2 in the current implementation.