Add support for disabling bad pipelines

If a CI system breaks, rather than reporting lots of failure
messages back to gerrit (or a reporter) instead disable the
pipeline. This is done by setting a disable after consecutive
failures so that if X failures happens in a row the pipeline
is considered disabled until zuul is reloaded.

Change-Id: Ia75f1909133627bfefb750c35188dc6d002e3bd1
diff --git a/zuul/model.py b/zuul/model.py
index 8dc28df..1c69e75 100644
--- a/zuul/model.py
+++ b/zuul/model.py
@@ -82,6 +82,10 @@
         self.start_actions = None
         self.success_actions = None
         self.failure_actions = None
+        self.disabled_actions = None
+        self.disable_at = None
+        self._consecutive_failures = 0
+        self._disabled = False
         self.window = None
         self.window_floor = None
         self.window_increase_type = None