commit 94db6b6e845fc3647cbf08a291b64f8f29b2b7fd
author Edwin Kempin <ekempin@google.com> Fri Sep 02 14:37:17 2016 +0200
committer Edwin Kempin <ekempin@google.com> Tue Sep 06 11:42:46 2016 +0200
tree 4b7256d9939c76f7d7910f71423ef9403f607021
parent 86cdf1b494f44095408567a6b98941e7a0ee8e43

Make permissions for tag creation consistent

For each tag type you need a special permission for the tag creation:
- Lightweight tags require 'Create Reference'
- Annontated tags require 'Push Annotated Tags'
- Signed tags require 'Push Signed Tags'

When creating a tag by push there are 2 cases:
1. The commit to which the tag points already exists in Gerrit
   (it is reachable from any branch/tag that is readable by the
   calling user)
2. The commit to which the tag points is new
   (it is not reachable from any branch/tag that is readable by the
   calling user)

So far the permissions that were required to push a tag on a new
commit were inconsistent:
- For lightweight tags we required 'Push' in addition to 'Create
  Reference'
- For annotated/signed tags 'Push Annotated Tags'/'Push Signed Tags'
  were sufficient.

Due to this it was not possible to allow pushing of annotated/signed
tags for existing commits, but not for new commits.

Change the behaviour for annotated/signed tags so that it's consistent
with the behaviour for lightweight tags and require 'Push' in addition
to 'Push Annotated Tags'/'Push Signed Tags', if the tag points to a
new commit.

We may consider renaming 'Push Annotated Tags'/'Push Signed Tags' to
'Create Annotated Tags'/'Create Signed Tags' later.

Add tests for the tag creation by push that cover lightweight and
annotated tags on existing and new commits. Tests for signed tags may
be added later.

Change-Id: I1094a2be4871e16239b6a6daefc537ffc77af3bf
Signed-off-by: Edwin Kempin <ekempin@google.com>