Replace most ChangeAccess queries with searches

Use the secondary index rather than depending on SQL indexes, which
will not be available in a notedb world. For the most part this change
is pretty straightforward, as the interface for InternalChangeQuery is
almost the same as for ChangeAccess. It also provides a bit more
functionality, such as limiting the results.

By default, all of these queries should bypass visibility checks,
since things like the submit queue necessarily need to see everything.
Even if it is properly running as InternalUser and that is hard-coded
to have visibility, it is simpler to just bypass the checks entirely.

The biggest complication comes from converting callers that previously
opened a new ReviewDb in a try/finally block and called a ChangeAccess
method directly from that. In the InternalChangeQuery model,
Provider<ReviewDb> needs to be injected, so we need to set the
ThreadLocalRequestContext with the manually-opened DB. To simplify
this code, add an AutoCloseable RequestContext implementation.

To save future schema churn, this change does not include a schema
change to drop the indexes.

Change-Id: I99de8a2cf2aba01971059b89df33b1676cd8546e

gerrit-server/src/main/java/com/google/gerrit/server/git/ReceiveCommitsAdvertiseRefsHook.java

@@ -101,8 +101,10 @@ public class ReceiveCommitsAdvertiseRefsHook implements AdvertiseRefsHook {
     final int limit = 32;
     try {
       Set<PatchSet.Id> toGet = Sets.newHashSetWithExpectedSize(limit);
-      for (ChangeData cd :
-          queryProvider.get().setLimit(limit).byProjectOpen(projectName)) {
+      for (ChangeData cd : queryProvider.get()
+          .enforceVisibility(true)
+          .setLimit(limit)
+          .byProjectOpen(projectName)) {
         PatchSet.Id id = cd.change().currentPatchSetId();
         if (id != null) {
           toGet.add(id);