This is the last commit of a longer series to hide the internal
implementation of Gerrit's permission schema and have all calls go
through PermissionBackend.
This commit moves all Control classes into server/permissions to avoid
direct calling from other classes in server/project.
Change-Id: Ifc8f0d3838fefafbb69bb4f0dfc5ca513a41b906
cd5265bd0f