Goldiloader (https://github.com/salsify/goldiloader) can eager load
associations automatically. This removes the need for adding "includes"
calls in a variety of different places. This also comes with the added
benefit of not having to eager load data if it's not used.

In Rails 5.0 `assert_template` and `assigns()` have been extracted to
the `rails-controller-testing` gem.
https://github.com/rails/rails/pull/20138/files

This commit adds this gem for rails5.

git 2.16 will fail badly if there are stale worktrees.

Closes #44115

Release notes: https://github.com/libgit2/libgit2/releases/tag/v0.27.0

This version solves a significant performance issue with generating
large diffs: https://github.com/libgit2/libgit2/issues/4460

Timecop was being used in the cycle analytics and burndown seed_fu tasks.
While it seems a little sketchy to use Timecop in this way, this seems like
an exception can be made for test fixtures.

Closes #44751, gitlab-org/gitlab-ee#5359

When a repository does not exist on a remote, Gitaly won't be able to
clone it. This is correct behaviour, but from the clients perspective a
change in behaviour.

This change implements the client side changes that allows Gitaly to
execute a `git ls-remote <remote-url> HEAD`. This way the client has no
need to shell out to Git.

In the situation where multiple Gitalies are available, one is chosen at
random.

This commit closes https://gitlab.com/gitlab-org/gitlab-ce/issues/43929,
while its also a part of https://gitlab.com/gitlab-org/gitaly/issues/1084

See:

* https://github.com/rails/rails-html-sanitizer/releases
* https://github.com/flavorjones/loofah/releases

[10.6] Fix GitLab Auth0 integration signs in the wrong user

See merge request gitlab/gitlabhq!2354

But first, rewrite the performance bar in Vue:

1. Remove the peek-host gem and replace it with existing code. This also allows
   us to include the host in the JSON response, rather than in the page HTML.
2. Leave the line profiler parts as here-be-dragons: nicer would be a separate
   endpoint for these, so we could use them on Ajax requests too.
3. The performance bar is too fiddly to rewrite right now, so apply the same
   logic to that.

Then, add features! All requests made through Axios are able to be tracked. To
keep a lid on memory usage, only the first two requests for a given URL are
tracked, though. Each request that's tracked has the same data as the initial
page load, with the exception of the performance bar and the line profiler, as
explained above.

This reverts merge request !17737