Warn & reset fw policy if limit is updated

[xmo-odoo]

odoo/enterprise#68916 got very confusing as after disabling forwardport the limit was reset yet it was not forwardported.

The answer is that since 7711d09 these are now two completely different items, and the limit is updated independently from the forward port policy (because PRs of the same batch can have different limits).

So when the limit was updated, it had no effect as the limit was already False ~ master. Thankfully the post-merge resumption did not check the forward-port policy, so went through.

• if the limit is updated on a PR in fw=no, notify the user
• if the limit is updated on a PR in fw=no, reset to fw=default
• check forward port policy in _maybe_update_limit, currently it unconditionally creates a forward-port task if the tip of the chain is merged (e.g. if the tip of the chain is the source and forward porting was disabled) which is inconsistent: if the tip is not merged then it just schedules a followup which does check for the policy
• perform forward-porting if fw is updated from no to default after merge, the same way up to does.
• check ACLs to make sure fw=default can be invoked by the PR author to reset from fw=no