Only include unpublished review requests in the API when requested.

Recently, a change was added that resulted in /api/review-requests/
returning all unpublished review requests for all users, when requested
by an admin. This could impact existing scripts, and potentially make
things harder for day-to-day work by users who happen to also be admins.

Now, the caller must pass ?show-all-unpublished=1 to get this new
behavior. That allows scripts to opt-in to this only when needed.

The flag on ReviewRequestManager was also renamed to
show_all_unpublished. If set, the resulting query is actually
simplified and doesn't do any public= or submitter= checks. Previously,
it resulted in a query like "public = true OR submitter = <user> OR
public = false", which was unnecessary.

The renaming of the flag also helps clear up confusion about its
relation to accessing private review requests (private by way of
group/repository settings).

Reviewed at https://reviews.reviewboard.org/r/6360/
Fix some validation issues and error display on Bitbucket.

It was common for people to put invalid repository names or usernames
into the Bitbucket repository config form. When this happened, we'd
either end up storing bad account information, fail with a cryptic
error, or crash.

Some of the most common problems here have been fixed.

We now check the the validity of the username and password prior to
storage. We fetch the user session API, using the credentials provided
by the user. The credential data is only stored if this succeeds.

If any API request results in an HTTP 401, we raise an
AuthorizationError. All other errors result in a HostingServiceError
(previously, we'd raise an Exception, which wouldn't always be caught
correctly). If the data from the server was a valid error payload, we
now parse that and display the error message.

Repositories are now validated properly as well. A repository name that
looks like a path (has a '/') or contains '.git' will immediately result
in an error instructing the user to provide just the name. If a name
meets the criteria, but is not found, a suitable error will also be
shown instead of a JSON payload.

Reviewed at https://reviews.reviewboard.org/r/6359/
Merge branch 'release-2.0.x'