Remainder of the tenant override tests, don't allow global administrators to break the spec by overriding values that are marked tenantOverride: false