Add a global capability to allow generating HTTP passwords

The capability `generateHttpPassword` allows non-administrator
users to generate HTTP passwords for users other than self.

This capability would typically be assigned to a non-interactive
group to be able to register HTTP passwords for users from a
tool or web service that uses the Gerrit REST API.

Change-Id: I3d77cd406b0258d68cd0b8bb4dfbdcec97112450
Fix: failed to validate Change-Id of some new patch-sets pushed by 'refs/changes'

Those new patch-sets pushed by 'refs/changes/xxxxx/new' or 'refs/changes/xxxxx' can not
get Change-Id validation, because the CommitValidators.NEW_PATCHSET can not match them.
Before 15d5ac0e7, the CommitValidators.NEW_PATCHSET was same with ReceiveCommits.NEW_PATCHSET
and there was not this hole. 15d5ac0e7 updated CommitValidators.NEW_PATCHSET to ensure validating
the Change-Id of [a] and [b].

This commit replaces CommitValidators.NEW_PATCHSET with ReceiveCommits.NEW_PATCHSET and only keep
the later one to plug this hole, and updates the ref name of ReceiveCommand for [a] and [b]
to keep [a] and [b]'s Chang-Id get validation as before.

 [a] is of new change:
    'refs/changes/nn/mmmnn/x' -> 'refs/publish/<branch name>
 [b] is of new patch-set of an existing change:
    'refs/changes/nn/mmmnn/x' -> 'refs/changes/nn/mmmnn/new'

Now the ref pattern of ReceiveCommand created via UI falls into line with those pushed via ssh
command.


[a]: new change created by 'Revert' button.
[b]: new patch-set created by 'Edit Commit Message' icon.

Change-Id: Idbc7764db9edcc067445e7246c03eb1c3e686955
Merge "Fix: failed to validate Change-Id of some new patch-sets pushed by 'refs/changes'" into stable-2.6
Merge branch 'stable-2.6' into stable-2.7

* stable-2.6:
  Fix: failed to validate Change-Id of some new patch-sets pushed by 'refs/changes'
Merge branch 'stable-2.7'

* stable-2.7:
  Fix: failed to validate Change-Id of some new patch-sets pushed by 'refs/changes'

Conflicts:
	gerrit-server/src/main/java/com/google/gerrit/server/ChangeUtil.java
	gerrit-server/src/main/java/com/google/gerrit/server/git/validators/CommitValidators.java

Change-Id: I89ffdf132ad320215b00d0628c07797157a1b925
Merge "Add a global capability to allow generating HTTP passwords"
Only handle last value change event for attached change screens

Bug: issue 1801
Change-Id: I2993a833d7547a234bdb6c36694f85913215b323
Merge "Only handle last value change event for attached change screens"
Fix PutHttpPassword to allow all intended use cases

The following should be supported:

  * caller can generate a new password
  * caller can delete their password

  * caller can generate a password for another user if caller
    has the generateHttpPassword capability.

  * administrator can generate, delete, or set any password.

Change-Id: I719fc72a44a82c6cabf69c77abb91c1e08c87f75
Make group specific REST API accessible from SSH command

Change-Id: I66255575519c91d60b2f550c475df55a0745872d
Add --wide option to show-connections

This adds the --wide (-w) option to show-connections, and also makes
it so both --wide and -w are acceptable for show-queue.  In addition,
the options for show-caches, show-connections, and show-queue have
all been documented accordingly (though, show-caches is a little
different in its behavior).

Change-Id: I6adee795763bda9533c3700216695945d8bb7af8
Support X-Gerrit-RunAs as a suexec on HTTP

If an HTTP request includes the header:

  X-Gerrit-RunAs: spearce

and is made by a user granted the runAs capability the request
will evaluate as though it was run by user "spearce", and not the
calling user. This roughly matches the behavior of suexec over SSH,
but for HTTP API requests.

The new header takes any specification for an account, accepting
Account.Id, email address, full name, or username.

Change-Id: Ieda546a0db7290e31a8941c1b761c219aa0b63f9
Merge "Support X-Gerrit-RunAs as a suexec on HTTP"
Merge "Make group specific REST API accessible from SSH command"
Do not fail with 500 Internal Server Error if user can't create branch

If a user can't create a branch the response is now 403 Forbidden.

Change-Id: I35b88e10d241ad4934caa091a9181df3b496395e
Signed-off-by: Edwin Kempin <edwin.kempin@sap.com>
Merge "Fix PutHttpPassword to allow all intended use cases"
Control X-Gerrit-RunAs with auth.enableRunAs variable

If auth.enableRunAs is set to false by the server administrators
the X-Gerrit-RunAs HTTP header will be rejected.

Change-Id: Ie6697ecd5a581bb170b5a1e0a83d7b0308cbffe1
Merge "Add --wide option to show-connections"
Merge "Do not fail with 500 Internal Server Error if user can't create branch"
Fix a bug in marking edits.

Previously, edits ending on newlines were not handled correctly.
Fixed by making advance() return a {line, ch} object that corresponds
to the first character of the next line.

Set "readOnly" to "true" instead of "nocursor". This fixes the
problem that text cannot be copied from the CMs.

Change-Id: I35686fd93bb87ce7aef95c122d1cbc53ae86f90c