Backport the new testing app.

This transitions the new testing app on master to older releases. This
contains utilities for making it easier to write new unit tests without
the need of slow-to-load fixtures, and adds fixture caching.
Filter inaccessible private review requests from queries.

Review requests that were not private to a user would still show up in
the All Review Requests page and in the /api/review-requests/ API. The
query function wasn't taking into account what should have been visible.

Now, ReviewRequest.objects.public() filters out such review requests if
the user cannot see them.

Many unit tests were added to test for these various combinations.
Prevent access to unjoined groups in the dashboard.

In the dashboard, it's possible to construct a URL to show review
requests for groups that you haven't joined. While normally harmless,
this is problematic for private groups, which should not be accessible.

Now, the only valid groups are those that the user is a member of.
All others will result in a 404.
Fix several access and payload issues with the REST API.

We had a handful of functions that weren't properly checking for valid access.
This only affected installations using local sites and private review requests,
and required knowledge of table IDs, but it was still possible to get access to
some information. This change ensures we have the proper decorators on all
functions (and removes some redundant decorators), and that access permissions
are checked in all cases.

There were also some issues in returning 404 when resources couldn't be
accessed, and a case where the wrong payload was returned. These have been
fixed as well.

This change does affect extensions that provide API resources. They will need
to provide a has_access_permisisons method that returns True if the user should
be able to access the resource. That's no longer going to allow access by
default, as it's now opt-in.
Don't show private review requests or groups on the user page.

The user page was showing the summaries of private review requests and
the names of invite-only groups, which was an information leak. We now
restrict the lists to those that the viewing user may see.
Release Review Board 1.6.19.
Filter inaccessible private review requests from queries.

Review requests that were not private to a user would still show up in
the All Review Requests page and in the /api/review-requests/ API. The
query function wasn't taking into account what should have been visible.

Now, ReviewRequest.objects.public() filters out such review requests if
the user cannot see them.

Many unit tests were added to test for these various combinations.
Backport HeaderActionHook and HeaderDropdownActionHooks to 1.7.

Cherry-picks 33ed256007 from master, with the one small modification
whereby we use the old-style dropdown.png instead of &#9662; in the
templates. This is for consistency, since that's what 1.7 always
used for the dropdown marker.

Reviewed at https://reviews.reviewboard.org/r/4703/.
Fix several access and payload issues with the REST API.

We had a handful of functions that weren't properly checking for valid access.
This only affected installations using local sites and private review requests,
and required knowledge of table IDs, but it was still possible to get access to
some information. This change ensures we have the proper decorators on all
functions (and removes some redundant decorators), and that access permissions
are checked in all cases.

There were also some issues in returning 404 when resources couldn't be
accessed, and a case where the wrong payload was returned. These have been
fixed as well.

This change does affect extensions that provide API resources. They will need
to provide a has_access_permisisons method that returns True if the user should
be able to access the resource. That's no longer going to allow access by
default, as it's now opt-in.
Add a new ExtensionResource for Review Board that is localsite aware.

This new ExtensionResource wraps the Djblets ExtensionResource, and
makes it work with Review Board's notion of localsites.

Reviewed at https://reviews.reviewboard.org/r/4660/.
Merge branch 'release-1.6.x' into release-1.7.x
Release Review Board 1.7.15.
Merge tag 'release-1.7.15' into release-1.7.x
Add a lintian tool for the webapi resources and tests.

This checks our webapi resources and test suites for issues. These
issues include:

* Missing decorators on the handlers
* Missing docstrings
* Missing test methods and suites
* Missing lists of errors for docs
* Missing permission checks

At this point, there's a lot of work to do before we pass all these
tests.
Fix several access and payload issues with the REST API.

We had a handful of functions that weren't properly checking for valid
access. This only affected installations using local sites and private
review requests, and required knowledge of table IDs, but it was still
possible to get access to some information. This change ensures we have
the proper decorators on all functions (and removes some redundant
decorators), and that access permissions are checked in all cases.

There were also some issues in returning 404 when resources couldn't be
accessed, and a case where the wrong payload was returned. These have
been fixed as well.

This change does affect extensions that provide API resources. They will
need to provide a has_access_permisisons method that returns True if the
user should be able to access the resource. That's no longer going to
allow access by default, as it's now opt-in.
Expand our REST API test suite, and simplify the codebase.

This enhances the API test suite to automate a bunch of the common tests
for resources. The standard GET, POST, PUT, DELETE tests that test basic
behavior, with local sites, and without access to local sites have all
been generalized through mixins. Tests for resources that exist as
direct or indirect children of ReviewRequestResource also have
additional tests that test for access when review requests are made
private.

Much of the test suite code has been removed in favor of the new
mixed in tests. An additional 20+ seconds of tests have been added.
Filter inaccessible private review requests from queries.

Review requests that were not private to a user would still show up in
the All Review Requests page and in the /api/review-requests/ API. The
query function wasn't taking into account what should have been visible.

Now, ReviewRequest.objects.public() filters out such review requests if
the user cannot see them.

Many unit tests were added to test for these various combinations.
Prevent access to unjoined groups in the dashboard.

In the dashboard, it's possible to construct a URL to show review
requests for groups that you haven't joined. While normally harmless,
this is problematic for private groups, which should not be accessible.

Now, the only valid groups are those that the user is a member of.
All others will result in a 404.
Restrict access to the users list of private review groups in the API.

The API for getting the list of users on a private review group was
still allowing access to all users, instead of just those who are
members of the group. This is now properly restricted.
Merge branch 'release-1.7.x'