NoteDb: Avoid writing partial change graphs

If we naively turn on notedb.writeChanges without previously running
RebuildNoteDb to backfill existing changes, a single ChangeUpdate may
end up writing a partial note graph, for example containing a single
commit with only a "Topic" field and no other information. Such a
partial graph will almost certainly fail to parse; better to avoid
writing them out in the first place.

Teach NoteDbUpdateManager to skip writing updates unless the first
update in the list has a special allowWriteToNewRef. This means
writing a change will automatically "turn on" on a per-change basis as
soon as a backfill is completed, whether in a running server or in
between restarts.

There are three cases where we want to allow writing updates to new
refs:
 - Any ChangeDraftUpdate, since having a "partial" draft notes ref
   doesn't cause parsing to fail, and executing the same update
   multiple times is idempotent with respect to the note data.
 - A ChangeUpdate that creates a change for the first time, which is
   by definition not a partial graph. This is handled in BatchUpdate,
   which already knows which ChangeUpdates correspond to new changes.
 - In ChangeRebuilder, which again is guaranteed to write a complete
   graph.

Change-Id: Ic8c6c28e68aef22be7569d2b0cb409eae22e3034

gerrit-server/src/test/java/com/google/gerrit/server/notedb/AbstractChangeNotesTest.java

@@ -204,7 +204,9 @@ public abstract class AbstractChangeNotesTest extends GerritBaseTests {
 
   protected ChangeUpdate newUpdate(Change c, CurrentUser user)
       throws Exception {
-    return TestChanges.newUpdate(injector, c, user);
+    ChangeUpdate update = TestChanges.newUpdate(injector, c, user);
+    update.setAllowWriteToNewRef(true);
+    return update;
   }
 
   protected ChangeNotes newNotes(Change c) throws OrmException {