Respect draft visibility when determining visibility of all refs

When determining whether or not all refs are visible, drafts were not
considered. Thereby, non-visible drafts could get pulled, or
non-visible drafts were browsable through gitweb.

As drafts are refs as well, we now check their readability as well,
when trying to determine whether or not all refs are visible.

This change makes 'View Drafts' permission mandatory to use the
internally managed gitweb, as there is no way to hide drafts from
there.

Change-Id: Id064c38986b667d00a8adcfcb4a31fc04f25cc23
Allow adding patch sets only to visible changes

Thereby, we prohibit adding patch sets to invisible drafts of others.

Change-Id: I7d942ccde77e8e779a87ef5b3862404bd3632365
Merge "Respect draft visibility when determining visibility of all refs" into wmf
Merge "Allow adding patch sets only to visible changes" into wmf