Ensure no ambiguous change IDs when deleting in the index.changes api

When deleteMissing is true, changes are potentially deleted from the
index, it's therefore crucial that we do not use an ambiguous change-id
formats that could lead to Gerrit deleting the wrong change from the
index.

This api essentially used a side-effect of ChangeFinder to identify if a
change was present or not:
- ChangeFinder uses the index to find the document if the identifier
  isn't a `project~changeNumber`
- If the entry is found on the index, it then tries to load the
  associated NoteDb data from the Git repository
- If the data is present in the index but NOT in NoteDb, then it
  returns an empty result

The above doesn't happen if the change is in `project~changeNumber`
format.

The code was relying on the above logic to infer that a change was in
the index, but not in NoteDb, by checking if the result was empty, which
is a side-effect rather than a direct contract behaviour.

Use the queryProvider to identify if a change is present in the index or
not, and, if it is, check on disk if it's actually present. To ensure we
don't use ambiguous changeIDs, force using project~changeNum as its the
true unique identifier of a change. Finally, fail the request with a 400
status code if not all change ids are in said format.

Release-Notes: Breaking change: require tilde changeIds in config/server/index.changes when requesting deletions and reject legacy numeric-only ids.
Bug: Issue 515272357
Change-Id: I8350971af868ee34b17fc8703aa9ef40c03f5ec5