Store callout block state in localStorage - #20462

Fixes #14950

Moves the collapsible and dismissable controllers from callout_block_* cookies
to localStorage, following notification_controller.js. This state is only ever
read by the browser, so sending it up in the headers on every request bought
nothing.

One behaviour change, and it is the interesting part

data-*-setting="global" existed to choose between a path=/ cookie and a
path-scoped one. localStorage is origin-wide, so it no longer means anything and
is removed along with the two template attributes.

What it was doing turns out to matter, though. Every collapsible already set it,
so those are unaffected. No dismissable did — so a dismissed callout was scoped
to the URL directory, which means the same explanatory callout had to be
dismissed again on every project you own. That reads like an accident rather
than a decision, and it now sticks the first time. Happy to preserve the old
scoping if it was deliberate.

Existing cookies are not migrated. The state is "has read this help text", so a
callout reappearing once costs a click, which seemed cheaper than a migration
shim someone has to remember to delete.

Not done

The issue floats converting all three controllers into one. That touches
notification_controller and its key naming too, so I left it — happy to follow
up if you want it.

Testing

npm test: 111 pass under TZ=UTC, both controllers at 100%. npm run lint
and djlint clean.

Both test files are rewritten. The old collapsible test seeded a
callout_block_settings_collapsed cookie against a fixture whose identifier was
project_roles, so the controller never saw it and the assertion passed for the
wrong reason. The new tests fail against the cookie implementation (5 failures)
and pass against this one.