update docs and All-Project configuration for gerrit 2.8

Changes for gerrit 2.8:
- In Gerrit 2.8 labels no longer need to be manually entered into the database.  To create
  custom labels we just need to define them in project.config file.
- There are two new ACLs (pushSignedTags[1] and streamEvents[2]) to configure in
  All-Projects config.
- The Workflow label replaces workInProgress permission (from WIP plugin)
  so removing workInProgress.

The 'Approved' label is replaced by the 'Workflow' label so updating the docs accordingly.

[1] https://gerrit-review.googlesource.com/Documentation/access-control.html#category_push_signed
[2] https://gerrit-review.googlesource.com/Documentation/access-control.html#capability_streamEvents

Change-Id: I8fd11f91fcb729d0d52234fb38da9fc6715b56f4
Merge "update docs and All-Project configuration for gerrit 2.8"