R1:4dfdd0d3167d

Treat invalid policies as broadly similar to "no one"

Summary:
Ref T3903. Ref T603. We currently overreact to invalid policies. Instead:

- For non-omnipotent users, just reject the viewer.
- For omnipotent users, we already shortcircuit and permit the viewer.
- Formalize and add test coverage for these behaviors.

Also clean up some strings.

The practical effect of this is that setting an object to an invalid policy (either intentionally or accidentally) doesn't break callers who are querying it.