Investigate lower granularity permissions model

Created by: dan-mckean

There are currently 2 code hosts that we partially support that, within their systems, allow for more granular permissions than just per-repo.

These are:

• Gerrit
• Perforce

More granular permissions for Perforce was delivered (more info here) but at the expense of treating directories as repositories. This creates problems as these directories are obviously not considered repos by users - more information about this and how to work around it.

Due to the pain felt with Perforce, and the request for support for Gerrit permissions (#23563 (closed)), the right approach is to consider how we could properly support more granular permissions.

The very general suggestion here is to consider a layer of abstraction between the permissions and the things that the permissions apply to, allowing permissions to be tied to something in the layer, and that handles what kind of thing they're applied to.