Bug 31533

Part of the 20380 set.
Building on top of 31503.

While we now only enforce the GDPR consent if the pref is set to Enforced, we leave other consents empty. Which actually is opt-in. They need to go to the consents page and enable the specific consent.

If we would add opt-out, we can either add consents for all users or make PatronConsent a bit smarter and only register refusal (opt-out).
It feels more consistent to add all consents to the table, and add them too in the self reg process. But when you add a new consent type and mark it as opt-out, we should then populate the table too.

Do we also need a Mandatory flag? Historically, we treat the GDPR consent as such. Other consents may not be of that same category. But we might want the user to make an explicit choice there without the same exceptional approach that we use for GDPR. How do we get him on that page? If he arrives there, we can obviously allow saving only when those mandatories are filled..