No longer push refs/changes to GitHub mirrors

By default gerrit replication pushes +refs/*:refs/*, which includes
refs/changes. For large repositories that potentially means hundreds
of thousands of references.

Per-repo git mirroring does not push refs/changes, so when it runs it
ends up deleting those references, which can take a long time, blocking
the executor.

To fix that, we should:
- stop pushing refs/changes to GitHub (this change)
- delete refs/changes on GitHub repositories, asynchronously
- enable per-repo replication
- disable Gerrit-wide replication

NB: it is unclear if Gerrit replication would start deleting the
    extraneous references on remote GitHub repositories once this
    merges. If this is the case, since replication is limited to a
    single thread (default value for 'threads') and is not happening
    in an executor, this should not have negative impact, beyond
    potentially delaying GitHub mirroring.

Change-Id: I94f69c889c9b4418ef81b3b2ca436ba99696ba72

playbooks/host_vars/review01.openstack.org.yaml

@@ -9,6 +9,9 @@ gerrit_replication:
       - '^openstack/(?!ara$|ara-web$|ara-infra$).*'
       - 'openstack-dev/*'
       - 'openstack-infra/*'
+    push:
+      - '+refs/heads/*:refs/heads/*'
+      - '+refs/tags/*:refs/tags/*'
   - name: 'gitea01'
     url: 'ssh://git@gitea01.opendev.org:222/'
     authGroup: 'Anonymous Users'

playbooks/roles/gerrit/templates/replication.config.j2

@@ -29,4 +29,9 @@ replicateOnStartup = false
 	projects = {{ project }}
 {% endfor %}
 {% endif %}
+{% if 'push' in replication %}
+{% for refspec in replication.push %}
+	push = {{ refspec }}
+{% endfor %}
+{% endif %}
 {% endfor %}