Consider allowing permission revocation calls for permissions that do not exist

`revokePermissions`, `revokeAllPermissions`, and related methods / actions of the `PermissionController` throw if the user is trying to revoke a permission that does not exist (which is either because a particular subject does not exist or because it doesn't have a particular permission). This was done in accordance with the design principle of "don't permit asking the impossible"; as a rule, it's important that an API is predictable and logically consistent, and that's doubly true if the API is sensitive, as is the case with the `PermissionController`.

Unfortunately, this design choice is causing downstream inconveniences, since callers always have to check if permissions exist before revoking them, even if the caller doesn't care if they ever existed in the first place. Therefore, it might make sense to modify the revocation methods such that the user can signal whether they care if a revoked permission actually exists or not.

Start by locating the PermissionController implementation and its related revocation methods and actions. Read how missing subjects or permissions currently produce errors, then inspect callers to understand the desired opt-in behavior. Done means callers can indicate whether a missing permission should be tolerated, with the existing strict behavior still available.

Written by the indexing model from the issue text.