Decouple superuser from SessionMetadata

Superuser should only be settable via the tool (see []
which is merged in here but not diffbased, and which removes
the implicit superuser for CharlestonRoad). It is a property
of the request, not of the session (there are no sessions in the tool).
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=125204707

java/google/registry/tools/ValidateLoginCredentialsCommand.java

@@ -110,6 +110,7 @@ final class ValidateLoginCredentialsCommand implements RemoteApiCommand, GtechCo
                 Optional.of(clientIpAddress),
                 "placeholder"),  // behave as if we have SNI on, since we're validating a cert
             false,
+            false,
             inputXmlBytes,
             null,
             new SystemClock()).run()), UTF_8));