Gerrit config: Make CQ a requirement for submission

A "NOPRESUBMIT=<reason>" footer can be used to bypass the requirement.

Manually tested via Gerrit REST API:

(Recent change that was submitted via CQ passes:)
gob-curl -X POST -H "Content-Type: application/json" -d '{"name":"CQ-Verified", "submittability_expression":"label:Presubmit-BoringSSL-Verified=MAX OR label:Commit-Queue=MAX"}' https://boringssl-review.git.corp.google.com/changes/boringssl~main~I831df6ae82bbc5d96baf976faa465cc76a6a6964/check.submit_requirement

(Recent change that was mistakenly directly submitted fails:)
gob-curl -X POST -H "Content-Type: application/json" -d '{"name":"CQ-Verified", "submittability_expression":"la
bel:Presubmit-BoringSSL-Verified=MAX OR label:Commit-Queue=MAX"}' https://boringssl-review.git.corp.google.com/changes/boringssl~main~Id536c67b781fcf0490f7e3a7c54b95746a6a6964/check.submit_requirement

In the event this is actually broken, refs/meta/config is excluded
from the requirement as an additional safety precaution. (And it does
not support CQ presubmits.)

Change-Id: I10e5d33efd6f21a3c98065069bcf3ff615c6774d
Reviewed-on: https://boringssl-review.googlesource.com/c/All-Projects/+/93027
Reviewed-by: David Benjamin <davidben@google.com>