Add support to reject changes from approvals

Formally "support for negative requirements"

This change adds support to reject a change from entering a pipeline
based off any existing approvals. This is useful to stop queuing any
changes with a negative vote.

Two new options are added:

reject:
  approval:
    - ...

To the pipelines, and:

reject-approval:
  - ...

To the triggers.

The approval format is the same for the "require approval" section.
Reject approvals could be considered a negative of the require section.

Change-Id: I3369920530e0b7439208b8fd43a9e75994860666
diff --git a/tests/fixtures/layouts/good_layout.yaml b/tests/fixtures/layouts/good_layout.yaml
index 9ba1806..3608d0c 100644
--- a/tests/fixtures/layouts/good_layout.yaml
+++ b/tests/fixtures/layouts/good_layout.yaml
@@ -4,9 +4,18 @@
 pipelines:
   - name: check
     manager: IndependentPipelineManager
+    require:
+      open: True
+      current-patchset: True
     trigger:
       gerrit:
         - event: patchset-created
+        - event: comment-added
+          require-approval:
+            - verified: [-1, -2]
+              username: jenkins
+          approval:
+            - workflow: 1
     success:
       gerrit:
         verified: 1
@@ -26,6 +35,16 @@
     manager: DependentPipelineManager
     success-message: Your change is awesome.
     failure-message: Build failed.  For information on how to proceed, see http://wiki.example.org/Test_Failures
+    require:
+      open: True
+      current-patchset: True
+      approval:
+        - verified: [1, 2]
+          username: jenkins
+        - workflow: 1
+    reject:
+      approval:
+        - code-review: [-1, -2]
     trigger:
       gerrit:
         - event: comment-added