Backport the new testing app.

This transitions the new testing app on master to older releases. This
contains utilities for making it easier to write new unit tests without
the need of slow-to-load fixtures, and adds fixture caching.
Filter inaccessible private review requests from queries.

Review requests that were not private to a user would still show up in
the All Review Requests page and in the /api/review-requests/ API. The
query function wasn't taking into account what should have been visible.

Now, ReviewRequest.objects.public() filters out such review requests if
the user cannot see them.

Many unit tests were added to test for these various combinations.
Prevent access to unjoined groups in the dashboard.

In the dashboard, it's possible to construct a URL to show review
requests for groups that you haven't joined. While normally harmless,
this is problematic for private groups, which should not be accessible.

Now, the only valid groups are those that the user is a member of.
All others will result in a 404.
Fix several access and payload issues with the REST API.

We had a handful of functions that weren't properly checking for valid access.
This only affected installations using local sites and private review requests,
and required knowledge of table IDs, but it was still possible to get access to
some information. This change ensures we have the proper decorators on all
functions (and removes some redundant decorators), and that access permissions
are checked in all cases.

There were also some issues in returning 404 when resources couldn't be
accessed, and a case where the wrong payload was returned. These have been
fixed as well.

This change does affect extensions that provide API resources. They will need
to provide a has_access_permisisons method that returns True if the user should
be able to access the resource. That's no longer going to allow access by
default, as it's now opt-in.
Don't show private review requests or groups on the user page.

The user page was showing the summaries of private review requests and
the names of invite-only groups, which was an information leak. We now
restrict the lists to those that the viewing user may see.
Release Review Board 1.6.19.
Filter inaccessible private review requests from queries.

Review requests that were not private to a user would still show up in
the All Review Requests page and in the /api/review-requests/ API. The
query function wasn't taking into account what should have been visible.

Now, ReviewRequest.objects.public() filters out such review requests if
the user cannot see them.

Many unit tests were added to test for these various combinations.
Fix several access and payload issues with the REST API.

We had a handful of functions that weren't properly checking for valid access.
This only affected installations using local sites and private review requests,
and required knowledge of table IDs, but it was still possible to get access to
some information. This change ensures we have the proper decorators on all
functions (and removes some redundant decorators), and that access permissions
are checked in all cases.

There were also some issues in returning 404 when resources couldn't be
accessed, and a case where the wrong payload was returned. These have been
fixed as well.

This change does affect extensions that provide API resources. They will need
to provide a has_access_permisisons method that returns True if the user should
be able to access the resource. That's no longer going to allow access by
default, as it's now opt-in.
Add a new ExtensionResource for Review Board that is localsite aware.

This new ExtensionResource wraps the Djblets ExtensionResource, and
makes it work with Review Board's notion of localsites.

Reviewed at https://reviews.reviewboard.org/r/4660/.
Merge branch 'release-1.6.x' into release-1.7.x
Release Review Board 1.7.15.
Merge tag 'release-1.7.15' into release-1.7.x