We had some hacky code in makePermissionsForChildrenBlob that was intended to strip the propagation prefix.

At the time it was written, there were only two prefixes, so it was easy to strip the propagation prefix by just constructing a new permissions string using only the filter prefix.

Now that we have three prefixes, it makes sense to do this in a more idiomatic way. This diff introduces constructThreadPermissionString, the inverse of parseThreadPermissionString. It allows us to construct a new permissions string based on a ParsedThreadPermissionString where we have cleared the `propagationPrefix.

Depends on D13015

The whole stack was tested as follows:

1. Unit tests from D9686, which toggle user-surfaced permissions on and off and make sure no difference is caught. This ensures that the original issue introduced in D9686 isn't reintroduced
2. Careful review of each descendant permission removed in D9686
3. Create a community as userA and add userB. Grant tagging permissions to all members. Make sure userB can tag inside non-root channels
4. Do above, then create a channel without userB, and make sure userB can't tag there either (or do anything other than view). This is the repro described here
5. Do above, but also create a thread inside the channel (as userA) and make sure userB can't do anything inside the thread other than view, until they join the parent channel