Add aiReview permission definition and check logic

Introduce a new aiReview ref permission that controls access to
AI review features. The permission uses default-allow semantics:
when no rules are configured, all users retain access. When ALLOW
rules are present, only granted groups can use AI features
(standard Gerrit model). DENY and BLOCK rules can also be used
standalone to restrict specific groups without requiring an
explicit ALLOW for everyone else.

This differs from standard Gerrit permissions which are
default-deny. The default-allow model is temporary for the
experiment phase. All experiment-specific code is marked with
`TODO(AI review experiment)` for cleanup when
`UiFeature__enable_ai_chat` is removed, at which point the
permission switches to standard default-deny via `canPerform()`.

Bug: Issue 483936085
Forward-Compatible: checked
Release-Notes: Add aiReview permission to control AI review access per-ref
Change-Id: I15625ee5fffc90f8dec887a98b0fecfab16e0f01