x/build/gerritbot: impersonate reviewer accounts

[FiloSottile]

The experience of only receiving messages from @gopherbot can be a bit impersonal and confusing. When migrating from Google Code we had gopherbot impersonate accounts. We could do the same for comments on PRs.

It would be opt-in but as long as the main reviewers are covered, I think it would achieve its goal.

/cc @andybons

[bradfitz]

We'd need to re-collect OAuth2 tokens from everybody. And resurrect the tool we'd built to collect them from users. And that means we need to be in the business of holding them. Previously we collected them once, proved to GitHub that we had them, and then GitHub mass-impersonated everybody for us (for those accounts we'd collected permission for), and then we deleted the tokens.

Doing this going forward means we're going from storing zero user data to non-zero user data (even if the number of users is less than 50 or 100), and that means a bit more paperwork sometimes.

We'd also need to maintain our Gerrit email <-> GitHub mapping table more.

So, we can do this. But it's work.

[andybons]

Removing NeedsDecision because that gets brought up at proposal meetings. We have the right people looking at this.

[mvdan]

Perhaps related to #24382, in how the bots should be special Gerrit users.