remove "Allowed" state for RootAccount features on root accounts

the "Allowed" state means a feature is off in an account, but
sub-accounts or courses below it are allowed to enable it.

the 'allowed' state does not, however, make a lot of sense for
features that apply to RootAccount. since the feature cannot
be controlled in sub-accounts or courses, the 'allowed' state
is equivalent to 'off' here.

so to make this less confusing, remove the "allowed" state
for RootAccount features.

(specifically, lock the transition in the API, and make the
UI hide buttons for locked transitions that don't have
messages to display when the user tries to perform them)

test plan:
 - set the Use New Styles feature to "Allowed" in Site Admin
   account settings
 - in a root account settings page, ensure the 'Allowed'
   option is not selectable for this feature
 - ensure that the API reports the new_styles feature is "off"
   and its "allowed" transition is locked
   i.e., GET /api/v1/accounts/1/features/flags/new_styles
   includes state: 'off' and transitions: {allowed: {locked: true}}
 - ensure the API refuses to set the new_styles feature to "allowed"
   in the root account
   i.e., PUT /api/v1/accounts/1/features/flags/new_styles?state=allowed
   should return a 403 error and not change the state
 - regression test: in a sub-account, ensure the 'Use New Styles'
   feature does not appear
 - regression test: verify that when a (non-site-admin)
   root account admin attempts to disable Draft State in
   an account, the Off button is still there, and a message appears
   when you click it, and the feature remains enabled

fixes CNVS-13220

Change-Id: I4d41076c10696b02d0c482a778d2555714487f17
Reviewed-on: https://gerrit.instructure.com/35473
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
Product-Review: Hilary Scharton <hilary@instructure.com>