Decouple superuser from SessionMetadata

Superuser should only be settable via the tool (see []
which is merged in here but not diffbased, and which removes
the implicit superuser for CharlestonRoad). It is a property
of the request, not of the session (there are no sessions in the tool).
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=125204707

java/google/registry/flows/OwnedResourceMutateFlow.java

@@ -31,7 +31,7 @@ public abstract class OwnedResourceMutateFlow
   /** Fail if the object doesn't exist or was deleted. */
   @Override
   protected final void verifyMutationAllowed() throws EppException {
-    if (!superuser) {
+    if (!isSuperuser) {
       verifyResourceOwnership(getClientId(), existingResource);
     }
     verifyMutationOnOwnedResourceAllowed();