Don't allow registering for cleanup after cleanup runs

We only run the cleanup code once per request.  After its run,
any new objects added onto the cleanup list for this request are
wrong and cannot be satisifed.

If we don't have this guard, a potential code change could ask
for a ReviewDb to be opened after cleanup was done, leaking the
database connection.

Change-Id: I854f6790b36cad4ad07356a7239c8648dc3937e4
Signed-off-by: Shawn O. Pearce <sop@google.com>

gerrit-server/src/main/java/com/google/gerrit/server/RequestCleanup.java

@@ -33,16 +33,21 @@ public class RequestCleanup implements Runnable {
       LoggerFactory.getLogger(RequestCleanup.class);
 
   private final List<Runnable> cleanup = new LinkedList<Runnable>();
+  private boolean ran;
 
   /** Register a task to be completed after the request ends. */
   public void add(final Runnable task) {
     synchronized (cleanup) {
+      if (ran) {
+        throw new IllegalStateException("Request has already been cleaned up");
+      }
       cleanup.add(task);
     }
   }
 
   public void run() {
     synchronized (cleanup) {
+      ran = true;
       for (final Iterator<Runnable> i = cleanup.iterator(); i.hasNext();) {
         try {
           i.next().run();