LocalSite admins were being shown as having all available permissions,

meaning that some code would appear to grant them permission (typically

for display) while others would disallow (when actually factoring in the

permission for anything real).
The main case where this was apparent was that LocalSite admins were

seeing "Delete Permanently" for review requests, though the option would

not work.
We now have a pre-defined list of valid permissions that LocalSite

admins can have. This was collected from all the call sites in the

codebase where permissions are checked. No other permissions are

considered available to the admin.

Unit tests pass.