Add support for branch level read permissions

Requested by: https://gitlab.my.salesforce.com/00161000004bZPD

User has code from several projects (customers) in one repo, with each project/customer on its own branch. For example they may have a branch “cust1” and a branch “cust2”, representing different - possibly competing – customers. They do not necessarily want the engineers working on cust1 to see cust2 and vice-versa, either for legal reasons, or just to make it harder to co-mingle the code. So they would like to setup something like:

•      “cust1” branch => block all users by default, only allow Cust1 engineers

•      “cust2” branch => block all users by default, only allow Cust2 engineers

•      “*” (all other) branches => allow all users (in some group(s))

And ideally they could set this independently for read access and write access.

cc/ @stanhu @twk3 @dblessing @JobV