Work towards replacing recursive namespace queries with linear queries.
This commit tracks the path to each namespace, and future work will
replace recursive queries with queries that utilize this new column.

This flag was tested in production w/o issues.

Because we search for permissioned labels which all have the same
top-level group, we can preset root_ancestor for them before permission
check. This optimization saves us extra query to fetch root ancestor
(called from group policy).