Add support to reject changes from approvals

Formally "support for negative requirements"

This change adds support to reject a change from entering a pipeline
based off any existing approvals. This is useful to stop queuing any
changes with a negative vote.

Two new options are added:

reject:
  approval:
    - ...

To the pipelines, and:

reject-approval:
  - ...

To the triggers.

The approval format is the same for the "require approval" section.
Reject approvals could be considered a negative of the require section.

Change-Id: I3369920530e0b7439208b8fd43a9e75994860666
diff --git a/doc/source/zuul.rst b/doc/source/zuul.rst
index d597f23..700c9f7 100644
--- a/doc/source/zuul.rst
+++ b/doc/source/zuul.rst
@@ -477,7 +477,13 @@
     of approval be present for the current patchset of the change (the
     approval could be added by the event in question).  It follows the
     same syntax as the :ref:`"approval" pipeline requirement below
-    <pipeline-require-approval>`.
+    <pipeline-require-approval>`. For each specified criteria there must
+    exist a matching approval.
+
+    *reject-approval*
+    This takes a list of approvals in the same format as
+    *require-approval* but will fail to enter the pipeline if there is
+    a matching approval.
 
   **timer**
     This trigger will run based on a cron-style time specification.
@@ -513,7 +519,13 @@
     of approval be present for the current patchset of the change (the
     approval could be added by the event in question).  It follows the
     same syntax as the :ref:`"approval" pipeline requirement below
-    <pipeline-require-approval>`.
+    <pipeline-require-approval>`. For each specified criteria there must
+    exist a matching approval.
+
+    *reject-approval*
+    This takes a list of approvals in the same format as
+    *require-approval* but will fail to enter the pipeline if there is
+    a matching approval.
 
 
 **require**
@@ -572,6 +584,23 @@
   reported by the trigger.  For example, when using the Gerrit
   trigger, status values such as ``NEW`` or ``MERGED`` may be useful.
 
+**reject**
+  If this section is present, it establishes pre-requisites that can
+  block an item from being enqueued. It can be considered a negative
+  version of **require**.
+
+  **approval**
+  This takes a list of approvals. If an approval matches the provided
+  criteria the change can not be entered into the pipeline. It follows
+  the same syntax as the :ref:`"require approval" pipeline above
+  <pipeline-require-approval>`.
+
+  Example to reject a change with any negative vote::
+
+    reject:
+      approval:
+        - code-review: [-1, -2]
+
 **dequeue-on-new-patchset**
   Normally, if a new patchset is uploaded to a change that is in a
   pipeline, the existing entry in the pipeline will be removed (with