Pick 10.2.4 security fixes into master

See merge request gitlab-org/gitlab-ce!15821

Add recaptcha_check_if_spammable for issualbes than arent spammables

See merge request gitlab-org/gitlab-ce!15817

Todo count calculations now expired quicker for top bar stats

See merge request gitlab-org/gitlab-ce!15794

Turn" push a file" into a scenario

See merge request gitlab-org/gitlab-ce!15617

Fix image view mode

Closes #40945

See merge request gitlab-org/gitlab-ce!15803

Convert Compare and CompareAutocomplete classes into ES module syntax

See merge request gitlab-org/gitlab-ce!14857

Fix gitlab:import:repos Rake task moving repositories into the wrong location

Closes #40765

See merge request gitlab-org/gitlab-ce!15823

If the source import directory were different from the destination directory,
GitLab would first create a blank repository and then erroneously move the
original one into a subdirectory. Adding an import type prevents this the project
from being initialized in the first place. It was accidentally removed in
1f917cbd49.

Closes #40765

prevent potential XSS when editing comment

See merge request gitlab/gitlabhq!2238

(cherry picked from commit 80ed6d25a46c0f70ec8baea78b5777118d63876c)

7480e462 prevent potential XSS when editing comment

Prevent creating issues through API without having permissions

See merge request gitlab/gitlabhq!2225

(cherry picked from commit c298bbaa88883343dc9cbbb6abec0808fb3b546c)

915b97c5 Prevent creating issues through API without having permissions

[10.2] Ensure we expose group projects using GroupProjectsFinder

See merge request gitlab/gitlabhq!2234

(cherry picked from commit 072f8f2fd6ec794645375a16ca4ddc1cbeb76d7a)

a2240338 Ensure we expose group projects using GroupProjectsFinder

(10.2) Avoid partial partial email adresses for matching

See merge request gitlab/gitlabhq!2232

(cherry picked from commit 081aa1e91a777c9acb31be4a1e76b3dd7032fa9a)

There are unresolved conflicts in app/models/user.rb.

fa85a3fd Don't allow searching for partial user emails

Fixes project visibility guidelines

See merge request gitlab/gitlabhq!2226

(cherry picked from commit 877c42c0aaf3298d6001614c9706bc366ae4014c)

e4fd1c26 Ensure project wiki visibility guidelines are met

Move the "Limit conflicts with EE" doc to "Automatic CE-> EE merge"

See merge request gitlab-org/gitlab-ce!15749

Allow git pull/push on project redirects

Closes #35385

See merge request gitlab-org/gitlab-ce!15670

Resolve "Deploy markers should be more verbose"

Closes #38032

See merge request gitlab-org/gitlab-ce!15641

Resolve "Include asset_sync gem"

Closes #40031

See merge request gitlab-org/gitlab-ce!15734

Fix N+1 query when displaying events

See merge request gitlab-org/gitlab-ce!15788

Use prefix for TableOfContents filter hrefs

Closes #38473

See merge request gitlab-org/gitlab-ce!15806

Fix invalid pipeline build chain tag evaluation

Closes #40944

See merge request gitlab-org/gitlab-ce!15805

assigned_open_merge_requests_count and assigned_open_issues_count, which are used in the top header stats.  Also important for a Geo secondary, so that the pending todo stat gets updated on the same frequency as the users open issues/merge requests.

TableOfContents filter generates hrefs for each header in markdown,
if the header text consists from digits and redacted symbols only,
e.g. "123" or "1.0 then the auto-generated href has the same format
as issue references.

If the generated id contains only digits, then 'anchor-' prefix is
prepended to the id.

Closes #38473

Merge branch '29483-no-feedback-when-checking-on-checklist-if-potential-spam-was-detected' into 'master'

Resolve "No feedback when checking on checklist if potential spam was detected"

Closes #29483

See merge request gitlab-org/gitlab-ce!15408

When displaying events we would load the target of those events, then
render the entire data using our Markdown pipeline. This pipeline would
eventually request the author of every target, leading to an additional
query being executed for every target to get the author.

To fix this we now eager load the author of the event's target. In my
local environment this reduces the number of queries to display a
project's Atom feed from 40 to 24 queries.

See https://gitlab.com/gitlab-org/gitlab-ce/issues/36878 for more
information.