[11.4] Fix Token lookup for Git over HTTP and registry authentication

See merge request gitlab/gitlabhq!2577

This refactors the TodoService class according to our code reuse
guidelines. The resulting code is a wee bit more verbose, but it allows
us to decouple the column names from the input, resulting in fewer
changes being necessary when we change the schema.

One particular noteworthy line in TodoService is the following:

    todos_ids = todos.update_state(state)

Technically this is a violation of the guidelines, because
`update_state` is a class method, which services are not supposed to use
(safe for a few allowed ones). I decided to keep this, since there is no
alternative. `update_state` doesn't produce a relation so it doesn't
belong in a Finder, and we can't move it to another Service either. As
such I opted to just use the method directly.

Cases like this may happen more frequently, at which point we should
update our documentation with some sort of recommendation. For now, I
want to refrain from doing so until we have a few more examples.

This refactors the TodosFinder finder according to the new code reuse
rules, as enforced by the CodeReuse cops. I also changed some of the
methods to use regular if statements, instead of assignments and/or
early returns. This results in a more natural flow when reading the
code, and it makes it harder to accidentally return the wrong result.

We don't think this is needed any more - see
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/21521, and
https://gitlab.com/gitlab-org/gitlab-ce/issues/52271 for removing the flag.

We simplify the query generated if the user can see all confidential issues in a
project context. This change applies the same simplification to group issue
lists.

Changes `Banzai::CrossProjectReference#parent_from_ref` to return the
project in the context if the project's `full_path` matches the ref
we're looking for, as it makes no sense to go to the database to find a
Project we already have loaded.

This isn't called from anywhere.

Signed-off-by: NDmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

In GET `api/v4/projects/:id/issues` the user can filter issues
that have an assigned milestone through the parameter
`milestone=Any+Milestone`.

Signed-off-by: NDmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

This commit adds the module `FromUnion`, which provides the class method
`from_union`. This simplifies the process of selecting data from the
result of a UNION, and reduces the likelihood of making mistakes. As a
result, instead of this:

    union = Gitlab::SQL::Union.new([foo, bar])

    Foo.from("(#{union.to_sql}) #{Foo.table_name}")

We can now write this instead:

    Foo.from_union([foo, bar])

This commit also includes some changes to make this new setup work
properly. For example, a bug in Rails 4
(https://github.com/rails/rails/issues/24193) would break the use of
`from("sub-query-here").includes(:relation)` in certain cases. There was
also a CI query which appeared to repeat a lot of conditions from an
outer query on an inner query, which isn't necessary.

Finally, we include a RuboCop cop to ensure developers use this new
module, instead of using Gitlab::SQL::Union directly.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/51307

In https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/19625 some
changes were introduced that do not meet our abstraction reuse rules.
This commit cleans up some of these changes so the requirements are met.

Most notably, sorting of the runners in Admin::RunnersFinder has been
delegated to Ci::Runner.order_by, similar to how we order data in
models that include the Sortable module. If we need more sort orders in
the future we can include Sortable and have Ci::Runner.order_by call
`super` to delegate to Sortable.order_by.

Partially addresses #47424.

This whitelists all existing offenses for the various CodeReuse cops, of
which most are triggered by the CodeReuse/ActiveRecord cop.

Signed-off-by: NDmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>