Check the committer rather than the Gerrit owner.

Guarding based on the Gerrit owner can be circumvented by an arbitrary
user uploading a different patch with a Change-Id that is non-unique,
with the other copy being owned by a Googler.

Change-Id: I5414b679e361d4c38d70bf9c4516c122f668fc49

tools/bionicbb/gerrit.py

@@ -24,6 +24,11 @@ class GerritError(RuntimeError):
         super(GerritError, self).__init__('Error {}: {}'.format(code, url))
 
 
+def get_commit(change_id, revision):
+    return json.loads(
+        call('/changes/{}/revisions/{}/commit'.format(change_id, revision)))
+
+
 def call(endpoint, method='GET'):
     if method != 'GET':
         raise NotImplementedError('Currently only HTTP GET is supported.')