[ci] Add unauthorized commit as another reason for builds not starting (#15324)

## Change Description

Follow on from #15307. Adds "unauthorized commit" as a reason why a
commit might have no builds, rather than assuming it's because the build
is queued. Also adds a button right next to the message on the PR page
for developers to authorize the commit/build immediately.

## Security Assessment

- This change potentially impacts the Hail Batch instance as deployed by
Broad Institute in GCP

### Impact Rating

- This change has a low security impact

### Impact Description

- Developer only page 
- Mostly just adds information. The only active functionality change
button is a duplicate of functionality that already exists elsewhere in
the UI, just somewhere less convenient.


### Appsec Review

- [ ] Required: The impact has been assessed and approved by appsec

Author: cjllanwarne

ci/ci/ci.py

@@ -193,10 +193,13 @@ async def _populate_batch_context(page_context: Dict[str, Any], batch: Batch) ->
         page_context['logging_queries'] = None
 
 
-async def _populate_active_pr_context(page_context: Dict[str, Any], wb: WatchedBranch, pr_number: int) -> None:
+async def _populate_active_pr_context(
+    page_context: Dict[str, Any], wb: WatchedBranch, pr_number: int, db: Database
+) -> None:
     pr = wb.prs[pr_number]
     page_context['pr'] = pr
     page_context['active_pr'] = True
+    page_context['pr_authorized'] = await pr.authorized(db)
 
     # Merge eligibility checklist
     page_context['review_approved'] = pr.review_state == 'approved'
@@ -271,7 +274,7 @@ async def get_pr(request: web.Request, userdata: UserData) -> web.Response:
     page_context: Dict[str, Any] = {'repo': wb.branch.repo.short_str(), 'wb': wb}
 
     if wb.prs and pr_number in wb.prs:
-        await _populate_active_pr_context(page_context, wb, pr_number)
+        await _populate_active_pr_context(page_context, wb, pr_number, request.app[AppKeys.DB])
     else:
         await _populate_historical_pr_context(page_context, request.app[AppKeys.GH_CLIENT], wb, pr_number)
 

ci/ci/templates/pr.html

@@ -132,7 +132,16 @@ <h3>Jobs</h3>
     </pre>
     {% else %}
     {% if active_pr %}
-    <p>Build queued - waiting for a build slot. <a href="{{ ci_base_url }}">View CI dashboard</a>.</p>
+      {% if pr_authorized %}
+      <p>Build queued - waiting for a build slot. <a href="{{ ci_base_url }}">View CI dashboard</a>.</p>
+      {% else %}
+      <p>Build blocked: this PR's latest commit is not authorized. It must be reviewed and approved manually by a developer before authorizing.</p>
+      <form action="{{ base_path }}/authorize_source_sha" method="post">
+        <input type="hidden" name="_csrf" value="{{ csrf_token }}"/>
+        <input type="hidden" name="sha" value="{{ pr.source_sha }}"/>
+        <button type="submit">Authorize now</button>
+      </form>
+      {% endif %}
     {% else %}
     <p>No builds found.</p>
     {% endif %}