Drop the capabilities reference from all user objects. Most global
capabilities can be checked with the PermissionBackend.
QoS, query limits, and emailing reviewers still require the capability
object. Bundle its factory into the call sites that need it.
Continue caching the CapabilityControl in an opaque property on the
CurrentUser, and also in the DefaultPermissionBackend.WithUserImpl.
Both of these sites reduce evaluations for critical properties like
"administrateServer".
Change-Id: I5aae8200e0a579ac1295a3fb7005703fd39d2696
6302ccb2bb