In order to update the permissions to fix ENG-8953, it's necessary to recalculate all of them.
We normally try to sync changes like this with client migrations to avoid introducing inconsistencies. However, in this case it's too hard for the keyserver to be able to respond differently to old clients versus new changes. Because the permissions changes here affect propagation from parent to child, the keyserver would either need to maintain two sets of permissions in MariaDB, or else to calculate the permissions on-the-fly by fetching all of a thread's ancestors.
Calling updateRolesAndPermissionsForAllThreads should generate UPDATE_THREAD updates for every single (Comm user, Comm thread) pair. That's a lot of updates, but it will make sure that permissions are fixed. We've run migrations like this before (in fact, the very last one)... experience is that it usually causes about 15min of downtime.
Depends on D13018