Block inheritance by default on per-branch permissions.

This change permits a single RefRight to block an ApprovalCategory for a given
ref. In other words, if there happens to be a change going to the project
tools/gerrit and that change is for the ref /refs/heads/master, given
the following rights:

in -- All Projects --:

Administrators  Code Review +2 refs/heads/*

in tools/gerrit:

gerrit-devs Code Review +2 refs/heads/*
Dr. No      Code Review +2 refs/heads/master

Then the change can only be Code Review +2 by members of the Dr. No group.

Change-Id: Ib72ac3cc7131c40d4209e438c70ae3e2b08e5830
4 files changed