I added the bits for the new prefix as high-order bits to maintain backwards compatibility.
Our new prefix only adds 1 bit to the minimally encoded role permission strings, we'll avoid triggering tHexEncodedRolePermission validation failure on existing clients.
Depends on D13014