title: Gerrit - how to disallow direct push to "master" but allow to other branches
body: <p>I want to set up configuration described below:</p>
  
  <ul>
  <li><p>Registered user can not push his changes directly to master. He has to push these changes for review:</p>
  
  <p><code>git push origin master</code> - it should be rejected by Gerrit (origin = Gerrit)</p>
  
  <p><code>git push origin HEAD:refs/for/master</code> - it should be allowed by Gerrit</p></li>
  <li><p>Registered user can create a new branch. This branch will be treated as a backup and a way of cooperation between two or more developers so it shouldn't be reviewed.</p>
  
  <p><code>git push origin xyz_abc</code> - it should be allowed by Gerrit</p></li>
  </ul>
  
  <p>How should I configure <code>Gerrit</code> to achieve such functionality ?</p>