Chain of Trust: Restrict git/hg branches

Today, @rpappalax came to me with an interesting case: he has some big changes to make on the focus-android taskgraph and he's willing to use a github branch (living the focus-android repo). This branch needs some taskcluster scopes.
He asked @imbstack to expand the following role: https://tools.taskcluster.net/auth/roles/repo%3Agithub.com%2Fmozilla-mobile%2Ffocus-android%3Abranch%3A*. Without too much context, all the scopes needed to sign and publish a Focus build ended up in the role (I actually wonder if these scopes were on the master role).

Immediate fix

I updated to role to strip all the signing/publishing scopes out. As of now, no one can publish Focus from a random branch on the main repo.

What scriptworker can do

In hg.mozilla.org, this is safeguarded by cot_restricted_scopes. Sadly, scriptworker doesn't allow to restrict branches within an existing repo. This case has never popped up on hg.mozilla.org, but we now have a case on github.

To me, scriptworker can enforce that. scriptworker knows what's the commit under checks. We can let it know what's the branch it's on. scriptworker will then verify against:

• github.com by fetching and parsing https://github.com/:user/:repo/branch_commits/:commit (for instance: https://github.com/mozilla-mobile/focus-android/branch_commits/1d0f51cd43f45a25b34191a5276d3f5d98023899). I couldn't find an API endpoint that exposes this piece of data.
• hg.mozilla.org withhttps://hg.mozilla.org/releases/mozilla-release/json-pushes?full=1&changeset=tip

This way scriptworker knows the branch against which the graph was triggered, and it knows the branch isn't a lie. Therefore, scriptworker can restrict by git/hg branches.

@escapewindow @tomprince, how does this look to you?

Start with scriptworker/constants.py, especially cot_restricted_scopes, and trace where the worker identifies the checked commit and repository. Compare GitHub's branch_commits endpoint with hg.mozilla.org's json-pushes response; done means branch restrictions are verified for both systems before restricted scopes are granted.