Decouple superuser from SessionMetadata

Superuser should only be settable via the tool (see []
which is merged in here but not diffbased, and which removes
the implicit superuser for CharlestonRoad). It is a property
of the request, not of the session (there are no sessions in the tool).
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=125204707

java/google/registry/ui/server/api/CheckApiAction.java

@@ -80,7 +80,6 @@ public class CheckApiAction implements Runnable {
   private final StatelessRequestSessionMetadata sessionMetadata =
       new StatelessRequestSessionMetadata(
           RegistryEnvironment.get().config().getCheckApiServletRegistrarClientId(),
-          false,
           ImmutableSet.of(FEE_0_6.getUri()),
           SessionSource.HTTP);
 
@@ -121,6 +120,7 @@ public class CheckApiAction implements Runnable {
           sessionMetadata,
           new PasswordOnlyTransportCredentials(),
           false,
+          false,
           inputXmlBytes,
           null,
           clock)