Make project state check in READ explicit

The majority of code in {Project,Ref,Change}Control is now about
permissions, but not all. Exceptions include checks for a project's
state. This is confusing, because users are presented with an exception
telling them that they lack some kind of permission while the real
reason for the failed operation is that the project's current state
doesn't permit the operation.

This is part of a series of commits to remove all project state checks
from *Control classes and make explicit checks instead.

Calls from resources in restapi/change/* need no explicit check if the
project state permits reads as this is checked in ChangesCollection.

Change-Id: Ifde8885cf48d7a63af52fe5ce3347f880f131d48

java/com/google/gerrit/server/query/change/EqualsLabelPredicate.java

@@ -30,6 +30,7 @@ import com.google.gerrit.server.project.ProjectCache;
 import com.google.gerrit.server.project.ProjectState;
 import com.google.gwtorm.server.OrmException;
 import com.google.inject.Provider;
+import java.io.IOException;
 
 public class EqualsLabelPredicate extends ChangeIndexPredicate {
   protected final ProjectCache projectCache;
@@ -123,8 +124,11 @@ public class EqualsLabelPredicate extends ChangeIndexPredicate {
     try {
       PermissionBackend.ForChange perm =
           permissionBackend.user(reviewer).database(dbProvider).change(cd);
-      return perm.test(ChangePermission.READ);
-    } catch (PermissionBackendException e) {
+      ProjectState projectState = projectCache.checkedGet(cd.project());
+      return projectState != null
+          && projectState.statePermitsRead()
+          && perm.test(ChangePermission.READ);
+    } catch (PermissionBackendException | IOException e) {
       return false;
     }
   }