Recently, a change was added that resulted in /api/review-requests/

returning all unpublished review requests for all users, when requested

by an admin. This could impact existing scripts, and potentially make

things harder for day-to-day work by users who happen to also be admins.
Now, the caller must pass ?show-all-unpublished=1 to get this new

behavior. That allows scripts to opt-in to this only when needed.
The flag on ReviewRequestManager was also renamed to

show_all_unpublished. If set, the resulting query is actually

simplified and doesn't do any public= or submitter= checks. Previously,

it resulted in a query like public = true OR submitter = <user> OR public = false,

which was unnecessary.
The renaming of the flag also helps clear up confusion about its

relation to accessing private review requests (private by way of

group/repository settings).

All unit tests pass.