Depends on D19583. Ref T13164. This continues the work of getting rid of requireCapabilities().

This check is valid, but can be a validateTransactions() check instead. This is generally more consistent with how other applications work (e.g., creating subprojects).

The UI for this isn't terribly great: you get a policy error after you try to create the object. But that's how it worked before, so this isn't any worse than it was. The actual policy exception is (very) slightly more clear now (raised against the right object).

• Created a child as a user with permission to do so to make sure I didn't break that.
• Set edit permission on a/ to just me, tried to create a/b/ as another user, got a policy exception since they can't edit the parent.