Fix file attachment URLs in change descriptions on local sites.

We didn't have the LocalSite name in the template, breaking links. This
fixes the templates to contain this information.

Reviewed at https://reviews.reviewboard.org/r/6262/
Remove the commit ID on a review request when discarded.

When posting a change for review with a commit ID and then discarding
it, that discarded review request still retains the commit ID. This
results in later conflicts with newly posted review requests, which
don't appear to break until the draft is published.

We now always remove the commit ID from the review request in order to
prevent any conflicts. While this is removing some history, it's history
that causes more harm than good and, since the review request is
discarded, it's not likely that the commit ID association is needed.
Merge branch 'release-2.0.x'
Factor in the LocalSite when handing ?to-groups= on ReviewRequestResource.

The ?to-groups= query was failing on LocalSites due to None being passed
for the local_site parameter in a call. It would only match global
groups.

We now pass the LocalSite we're querying, ensuring that groups matching
that will be looked up.

Fixes bug #3539
Prevent conflicts with commit IDs when dealing with drafts.

There were a series of errors that could result from commit ID conflicts
between review requests and drafts. There were a couple scenarios in
which a conflict could arrise:

* Updating a draft with a commit ID and then posting a new review
  request with the same commit ID.

* Updating two drafts with the same commit ID and trying to publish
  both.

A lot of these problems were due to us relying on database-level
validation for conflict reporting, and not factoring in drafts at all.

We now check for both review requests and drafts with the provided
commit ID before allowing any operations that would result in commit ID
assignment to either a review request or its draft. For the case of
creating a new review request, we do this regardless of whether the
create_from_commit_id flag is set.

Fixes bug #3508
Reviewed at https://reviews.reviewboard.org/r/6264/
Don't allow access to the API Tokens resource if using an API token.

This change blocks off access to the user's API Tokens resource if the
user is logging in through an API token. They instead have to log in
using their main username and password.

This prevents a vulnerability where a client using a restricted API
token that still had read access to the API Tokens resource would be
able to look up a more permissive token and use that.

There's a new 'api_token_access_allowed' flag on resources that can be
turned off to prevent token-based access.

Some work had to be done to the basic tests mixins to only perform the
API tokens test if the unit tests don't turn it off.

Reviewed at https://reviews.reviewboard.org/r/6257/
Add Webhooks and Hosting Accounts to the admin sidebar.

This adds handy links for managing or adding Webhooks or hosting
accounts to the admin UI's sidebar. These are some of the more common
database tables that may need to be modified, so we don't want users to
have to dig for them.

While in here, I cleaned up some indentation issues.

Reviewed at https://reviews.reviewboard.org/r/6259/
Fix a broken FileDiff migration unit test from a merge.

The FileDiff migration tests that came from release-1.7.x were assuming
the existence of Repository objects in fixtures, which isn't the case in
release-2.0.x. This switches to using create_repository() instead.
Merge branch 'release-2.0.x'
Fix the file-attachment template for non local-site review requests.

The emergency fix we slipped in last night for fixing local sites broke review
requests that weren't on local sites.

Testing done:
After this patch, I could open a review request with some changes to file
attachments again.

Reviewed at https://reviews.reviewboard.org/r/6266/
Merge branch 'release-2.0.x'