This resolves ENG-9053.

In D13061, I accidentally limited these permissions to top-level (non-sidebar) descendants, instead of granting them for all descendants.

We only need to use TOP_LEVEL_DESCENDANT in cases where we want to restrict the permission for sidebars… for instance, we don't want sidebars to have children, so we use TOP_LEVEL_DESCENDANT for sidebar and subchannel creation permissions.

1. I set up a repro of the issue in my local environment
2. I applied this diff to fix the issue
3. I reset db_version to 67 to trigger migration 68 again
4. After migration 68 ran again, I confirmed that the issue was gone