feat(gerrit): add code-owners plugin

This is the New Thing that is intended to replace the find-owners
and owners plugins.

In particular:

* It inserts a submit requirement rather than providing a Prolog
  predicate.
* The default OWNERS file formats are suspiciously Googley.
* It provides a neat UI for finding OWNERS and tracking approval
  state on a per-file basis.

When we fully migrate to using the code-owners plugin, a few
things will need to land, which I will likely do "offline"
directly to the Gerrit backing Git repos:

* Add the corresponding Gerrit config
* Replace OWNERS files depot-wide
* Add OWNERS files to the refs/meta/config branch
* Introduce the Owners-Override label, settable by depot-interventions

The enclosed patch adds two extra pieces of functionality that
we need in tvldepot but aren't upstream:

1. The ability to just specify usernames rather than email addresses
2. The ability to specify `group:GROUPNAME`, _as long as_ that group is
   visible to everyone. This is a restriction intended to avoid having
   the plugin just leak group membership.

Change-Id: I27d92b6cb7449af83030b9015f09a1571aa8452f
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6664
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
Reviewed-by: sterni <sternenseemann@systemli.org>

third_party/gerrit_plugins/builder.nix

@@ -1,4 +1,4 @@
-{ depot, pkgs, ... }:
+{ depot, lib, pkgs, ... }:
 {
   buildGerritBazelPlugin =
     { name
@@ -8,7 +8,7 @@
         cp -R "${src}" "$out/plugins/${name}"
       ''
     , postPatch ? ""
-    ,
+    , patches ? [ ]
     }: ((depot.third_party.gerrit.override {
       name = "${name}.jar";
 
@@ -26,10 +26,14 @@
       installPhase = ''
         cp "bazel-bin/plugins/${name}/${name}.jar" "$out"
       '';
-      postPatch =
-        if super ? postPatch then ''
-          ${super.postPatch}
-          ${postPatch}
-        '' else postPatch;
+      postPatch = ''
+        ${super.postPatch or ""}
+        pushd "plugins/${name}"
+        ${lib.concatMapStringsSep "\n" (patch: ''
+          patch -p1 < ${patch}
+        '') patches}
+        popd
+        ${postPatch}
+      '';
     }));
 }