Run plugin startup and shutdown as PluginUser

When a plugin is loaded at server startup the request context is
pointing to an AnonymousUser instance.  This prevents plugins from
resolving internal groups that are not anonymously visible.  Instead
set the request context to be an instance of PluginUser, which extends
InternalUser, a privileged type that can see any group.

This also fixes the inconsistent behavior when reloading plugins.
Plugins always start with the same PluginUser identity and never
inherit the identity of the caller performing the reload or install.

Bug: issue 1827
Change-Id: Icf9991bebefce3239048f902f828473f07dfc284

gerrit-server/src/main/java/com/google/gerrit/server/InternalUser.java

@@ -31,6 +31,8 @@ import java.util.Set;
  * anything it wants, anytime it wants, given the JVM's own direct access to
  * data. Plugins may use this when they need to have a CurrentUser with read
  * permission on anything.
+ *
+ * @see PluginUser
  */
 public class InternalUser extends CurrentUser {
   public interface Factory {