I added the bits for the new prefix as high-order bits to maintain backwards compatibility.

Our new prefix only adds 1 bit to the minimally encoded role permission strings, we'll avoid triggering tHexEncodedRolePermission validation failure on existing clients.

Depends on D13014

The whole stack was tested as follows:

1. Unit tests from D9686, which toggle user-surfaced permissions on and off and make sure no difference is caught. This ensures that the original issue introduced in D9686 isn't reintroduced
2. Careful review of each descendant permission removed in D9686
3. Create a community as userA and add userB. Grant tagging permissions to all members. Make sure userB can tag inside non-root channels
4. Do above, then create a channel without userB, and make sure userB can't tag there either (or do anything other than view). This is the repro described here
5. Do above, but also create a thread inside the channel (as userA) and make sure userB can't do anything inside the thread other than view, until they join the parent channel