This seems the right thing for most usages, but I notice two places
where it is the wrong thing.  One is that the default permissions on
TOAST rels should be no-access, not world-readable; the other is that
PrepareForTupleInvalidation doesn't really need to spend time looking
at tuples of TOAST relations.