Add acceptance test coverage

The plugin had no tests. Add ReparentIT, a
LightweightPluginDaemonTest with thirteen tests covering the REST
endpoint, the plugin's own permission model with non-admin users,
and the jail/protectorate policy rules from gerrit.config:

* an administrator can reparent a project and the new parent is
  visible through the projects API;
* a user without any grant gets 403;
* a user holding only the reparent-reparentProject plugin
  capability can reparent any project;
* a user holding only reparent-reparentOwnProject can reparent a
  project they own, and gets 403 on a project they do not own;
* an unknown target parent is rejected with 422;
* a child of a configured jail cannot be moved away from it, but
  may move within the jail subtree;
* a project outside a configured protectorate cannot be moved
  under it, while a project already inside may move within it;
* an administrator bypasses both jail and protectorate rules;
* reparenting All-Projects is rejected by the core endpoint.

The BUILD file gains a gerrit_plugin_tests rule so the suite runs
in-tree via bazel test //plugins/reparent:reparent_tests.

Test Plan: bazelisk test //plugins/reparent:reparent_tests
Change-Id: I2e8d0f61a94c37b528e1f04d7c65a29318f5b7da