Restricted-branch code submission via shared-topic ACL bypass

Incorrect authorization in Gerrit Code Review 2.12 and later allows remote authenticated users to merge unapproved code into restricted branches. When change.submitWholeTopic is enabled, the create or update path accepts a submit option on one branch and links visible changes sharing its topic without enforcing each target branch's submit requirements. Exploitation requires force-push permission on a secondary branch, an unapproved visible change with a matching topic, and the nondefault whole-topic setting; the result is unauthorized repository modification.