Restrict pushes / merges to a protected branch to specific groups

- Closes #675 and https://gitlab.com/gitlab-org/gitlab-ce/issues/21153
- Related to #179 

**Default State**
![Screen_Shot_2016-09-22_at_12.53.27_PM](/uploads/3777bc09fc5b0f9ddeccbf52dbf0277e/Screen_Shot_2016-09-22_at_12.53.27_PM.png)

**Filtering**
![Screen_Shot_2016-09-22_at_12.53.39_PM](/uploads/1e649e2a3720a4b0d7ff3e4fbafe5a72/Screen_Shot_2016-09-22_at_12.53.39_PM.png)

# Tasks

- [ ]  ee#675 !645 Restrict pushes/merges to specific groups
    - [x]  Implementation
        - [x]  Basic model-level implementation
        - [x]  Test / refactor
        - [x]  Rudimentary frontend (controller actions + autocomplete for the dropdown)
            - [x]  Groups that a project hasn't been shared with can't be selected
        - [x]  Look for edge cases
    - [x]  Questions
        - [x]  What are LDAP group links?
            - A GitLab group can be synced with one or more LDAP groups
            - The sync happens in an async task, an the LDAP group users are _imported_ into the GitLab group
            - `group.users` on a GitLab group returns the LDAP group users as well (after the import task has run)
            - We check `group.users` for this feature, so we shouldn't need any additional work to support LDAP groups
    - [x]  CHANGELOG
    - [x]  Removing a group should remove the access
    - [x]  `autocomplete/groups` issue
    - [x]  Fix uniqueness validation
    - [x]  Assign to @alfredo1 for UI work
    - [x]  Wait for !581 to be merged
    - [x]  Rebase against EE master instead of !581
    - [x]  Add feature specs
    - [x]  Implement frontend
    - [ ]  Assign to endboss
    - [ ]  Get backend + frontend reviewed
    - [ ]  Wait for merge


See merge request !645