We want to be able to do an ACL check during validate(), which means
having a ChangeControl available.
All callers either have one at the call site, or are already
constructing a RefControl, so they can just as easily construct a
ChangeControl instead. The main reason not to do this is to avoid
accidentally using that field rather than the control from the
ChangeContext which was read in a transaction. Try to avoid this by
giving it a non-obvious name and leaving a comment about it.
Change-Id: If0684a488e33850ddd18395a9f49bf4a40823fbc
e8190013bc