Enforcing publishing permission from the Web application
This adds checks in the Web application to ensure that the current user has publishing permissions for actions done in the UI or with the API that create public changesets:
- merging of Merge Requests
- direct commit creations
This could be done with branch protection and is actually not so far from it, except that it's intended to really correspond to publication, which can be different (see the example of direct commits, which can be draft).
We should add on top of that a complete permission check in the Mercurial process, and we will, but not in the stable branch.