Low level enforcement of Mercurial permissions from the Rails app
This is the follow-up to #332 (closed): when performing Mercurial actions, the web app must pass down the needed information so that Mercurial can perform the necessary checks (publication, notably).
This will duplicate the a priori checks that the web application already does but that's a necessary evil:
- it is the only way not to be more permissive in the Web app than in direct pushes done with a client.
- it does not have the same atomicity as protections in the Rails app, meaning we need to keep the latter as well. The typical example is the merge with explicit changeset sequence: with low level protections only, Mercurial will not refuse to perform the merge commit (as a draft), but it will refuse the later publication. This leaves a situation that a Maintainer can clean up (e.g., with a prune), but is still suboptimal.