Fix permission handling

Users with MAINTAIN_SERVER capability were not able to get or change
the read only state. The reason was, that the @RequireAnyCapability
annotation does not support GlobalCapabilities provided by Gerrit core
in plugins.

This change fixes that by making an explicit permission check.

Change-Id: Ie38143587b9bd8dad2fabb2107e3195f6a3c1a90