deny_execmem logic is inverted

[RoyalOughtness]

the naming of deny_execmem implies that if it is set to true, then execmem will be denied. However, the opposite is the case, for example:

tunable_policy(`deny_execmem',`',`
	allow rpm_script_t self:process execmem;
')

It's for this reason that deny_execmem is set to false, even though the intent and effect is to deny execmem:

gen_tunable(deny_execmem,false)

This is highly confusing and should be renamed to allow_execmem and remain false by default. This would accurately capture the intent: that allowing execmem is disabled/false.