This refactor helps prevent this mistake from happening again in the future.

Depends on D13019

The whole stack was tested as follows:

1. Unit tests from D9686, which toggle user-surfaced permissions on and off and make sure no difference is caught. This ensures that the original issue introduced in D9686 isn't reintroduced
2. Careful review of each descendant permission removed in D9686
3. Create a community as userA and add userB. Grant tagging permissions to all members. Make sure userB can tag inside non-root channels
4. Do above, then create a channel without userB, and make sure userB can't tag there either (or do anything other than view). This is the repro described here
5. Do above, but also create a thread inside the channel (as userA) and make sure userB can't do anything inside the thread other than view, until they join the parent channel