This patch adds support only for BLOCK permissions because ALLOW permissions
are double-keyed and will be included via a subsequent patch.
Support for a global BLOCK permission is not added here because of
inconsistencies in the way this interacts with device-specific ALLOW
permissions.
Differential Revision: https://phabricator.services.mozilla.com/D170303