Gate Keeping: Add support for "on behalf of" for submit operation

This change allows submit operation to be done on behalf of another user.

To use this option the caller must have been granted both `Submit` and
`SubmitAs` permission.  The user named by `on_behalf_of` does not need to
be granted `Submit` permissions.

This feature is aimed for CI solutions with "Gate Keeping" characteristic
(OpenStack's Zuul [1]): the Gate Keeper (CI account) can be granted both
permissions, so individual users don't need `Submit` permission themselves
(in fact they can't submit at all, only Gate Keeper can submit in this
scenario).  Still the changes are submitted on behalf of real users and
not with the identity of the Gate Keeper.

[1] https://github.com/openstack-infra/zuul

Inspired-by: Chad Horohoe <chorohoe@wikimedia.org>
Change-Id: Ifc250c0b576ebd4b7dce26c357557898b87ec705

gerrit-extension-api/src/main/java/com/google/gerrit/extensions/api/changes/SubmitInput.java

@@ -16,4 +16,5 @@ package com.google.gerrit.extensions.api.changes;
 
 public class SubmitInput {
   public boolean waitForMerge;
+  public String onBehalfOf;
 }