x/build: require TryBot-Result+1 or a new Ignore-TryBot label to submit CLs

[heschi]

Once TryBots have failed on a CL, the open comment thread serves to remind people to make them pass before submitting. However, nothing reminds authors/reviewers to run them in the first place. This is particularly annoying if you need a second Googler +1 vote, since https://go.dev/s/needs-review requires a passing TryBot run.

We can remind people that they need to run TryBots, and make it less likely that people will accidentally bypass them, by requiring an explicit vote from either an approver or the TryBots themselves for submission.

Specifically, we would add a submit requirement like label:TryBot-Result=+1 OR label:TryBot-Bypass=+1. The name of the new label is up for bikeshedding.

cc @golang/release

[heschi]

@rsc suggests we could look into blocking on unresolved comments as well.

[heschi]

Done.

[gopherbot]

Change https://go.dev/cl/452135 mentions this issue: cmd/gopherbot: rely on Gerrit config for TryBot and resolved comments