Generate URL prefixes with the right scheme

The main system identity's URL prefix, which is set during
installation and has no UI for configuration, used HTTP as the
scheme regardless of how the system was configured to be accessed
or the context (anonymous user or not) in which the URL would be
displayed.

Changed now so that the URL prefix is represented in the database
as a scheme to use for anonymous users, a scheme to use for
authenticated users (may be the same, of course,) and a hostname.
Add support for "variant" operation arguments

Declared as a set() of accepted types.  This overloads the existing use
of set() (of strings) for "enumerated values", but compatibly so.  Before
this change, any set() not containing only strings would have triggered
an error, and after this change a set() containing only strings work the
same way as before.
Add Operation.requireRole() helper function

Raises an OperationFailure exception saying "Operation not permitted" if
the user doesn't have the required role.
Add support for non-obtrusive client-side notifications

Add function showNotification() that client-side scripts can use to show
a non-obstrusive "notification" style message.  Currently displayed (fixed
positioned) at the top of the page for a few seconds, then fades away.
Display delegates value in human-readable form

Or, actually, just add a space after the commas.  This helps formatting
by allowing the client to line-break between names.
Run installation.prefs after installation.migrate

Motivation: it's more likely that preference installation depends on
database schema modifications done by migration scripts than that
migration scripts depend on preferences in the database.

(Specifically, upcoming restructuring of how preferences are stored in
the database makes this very much the case.)
Support per-repository and per-filter preferences

Support different default settings per repository, and different user
overrides per repository and per filter.  Not all preferences can be set
per repository or filter; this is indicated by flags in the 'preferences'
table.  (Essentially this depends on whether the code that reads the
preference passes in the relevant repository or filter parameters, and
will be determined and implemented per setting.)

Also "modernize" the UI on /config.  Scrap the "Save Settings" button in
favor of automatic saving triggered by changes.

Also add support for editing system defaults and repository defaults,
available to users with the administrator role.

Also change how system default values are stored.  Instead of storing
those values in columns in the 'preferences' table, store them as rows in
the 'userpreferences' table with uid=NULL.  (The 'userpreferences' table's
name is by now quite inaccurate.)
Make commit.diff.rulerColumn configurable per repository
Make review.defaultOptOut configurable per repository and filter

Policy (also documented in the code):

If all of the user's filters that matched files in the review have
review.defaultOptOut enabled, then opt out.  When determining this, any
review filters of the user's that match files in the review count as
filters that don't have the review.defaultOptOut enabled.

If any of the user's filters that matched files in the review have
review.defaultOptOut disabled, then don't opt out.  When determining
this, review filters are ignored.

Otherwise, ignore the filter settings, and go with either the user's
per-repository or global setting (as set above.)
Check if closed review is merged to master

If it is, say so under the big "Finished!" text.
Include user ID (or lack thereof) in review front-page ETag
Remove unnecessary repository name restrictions
Improve description of new upstream in 'review rebased' mails
Don't report unread news for anonymous users

Anonymous users can't read (as in "mark as read") news, so any unread
news would be unread forever.
Increment review serial number when rebasing

For a move rebase it was typically done anyway as part of adding
a commit (equivalent merge or replayed rebase) to the review, even
when that commit is "empty" and not later displayed in the list of
commits on the review front-page.  (Incrementing twice is not a
problem.)

For a history rewrite rebase, however, it was not typically done.
Don't ignore failure to replay merge silently

Early on, the replay mechanism wasn't stable, and failures were
silently ignored to prevent it from blocking usage (since it's
strictly speaking entirely possible to review a rebase without it.)

It should be stable now, however, so ignoring errors now only
serves to hide regressions from view.
Make internal cloning more robust

Some git operations create pack-*.keep files to keep certain pack
files alive.  They are created with the access bits 0600, which
means they are only accessible to the user performing the operation.
While such inaccessible pack-*.keep files exist, it may (depending
on the file system, kernel, and possible Git version) be impossible
to perform a "--local" clone of the repository.

Deal with this issue by silently falling back to cloning using the
safer but slower "Git aware" transport mechanism by using a file://
repository URL.  This will copy all files, so uses more disk space
and takes longer, but should at least not fail.

Also drive-by fix an clean-up bug in the relaycopy() and workcopy()
functions: they removed the repository clone, but not the temporary
directory into which the repository was cloned, leaving lots of
empty directories under /var/lib/critic/{temporary,relay}/.
Extend 012-replayrebase.py to test a bit more

Make it add some (quite a lot of, actually) files as part of the
rebase, to trigger a non-empty "rebase diff" and to create a new
pack file in the repository when pushing (which in turn causes the
existence of an inaccessible pack-*.keep file when the rebase
replay mechanism clones the repository, and thus tests our handling
of that.)
Show the error, not HTTP 500 when commit range starts with merge commit

WrappedResult doesn't do "value = str(value)" in next() so the
generators currently have to emit strings. It might be useful
with generators that emit non-strings for something in the
future but a generator of htmlutils.Document objects makes little
sense so convert to more modern DisplayMessage with a capital D
instead.

Repro steps for the HTTP 500 were:
1. add critic as a repo in critic
2. /showcommit?first=57a886e6352b229991c81e7ba43244ace7e02d76&last=b2b78ca013b49c73231bee11674bcdb3edf6d3f2
Add TC for "HTTP 500 when commit range starts with merge commit"