This will allow to download a repo using the token from the DeployToken

Includes:
- Model, factories, create service and controller actions
- As usual, includes specs for everything
- Builds UI (copy from PAT)
- Add revoke action

Closes #31591

We've seen changes in behavior in the reCAPTCHA widget that led to test failures.
To avoid these issues, don't render the widget at all in test mode.

Closes #45138

Signed-off-by: NRémy Coutable <remy@rymai.me>

Signed-off-by: NRémy Coutable <remy@rymai.me>

git 2.16 will fail badly if there are stale worktrees.

Closes #44115

Repository archives are always named `<project>-<ref>-<sha>` even if
the ref is a commit. A consequence of always including the sha even
for tags is that packaging a release is more difficult because both
the ref and sha must be known by the packager.

- add `<project>/-/archive/<ref>/<filename>.<format>` route using the
`-` separator to prevent namespace collisions. If the filename is
`<project>-<ref>` or the ref is a sha, the sha will be omitted,
otherwise the default filename will be used.
- deprecate previous archive route `repository/<ref>/archive`

If the ref hasn't been fetched into the target repository yet, this will fail
with a Rugged::ReferencError (assuming we're not using Gitaly). We should handle
this in the same way as a missing ref.

Closes #37462.

The merge request counter in the UI was not decreasing when a merge
request was deleting.

This was just due to the cache not being
refreshed on a delete action.

fixes: https://gitlab.com/gitlab-org/gitlab-ce/issues/44458

Since we can regenerate `description_html` from the `description`, we
should not export it. This avoids some complexity when overriding the
description during an import/export where we would need to invalidate
this cached field.

Now we refresh the markdown cache after the import

read_project can be prevented by a very expensive condition, which we want to
avoid, while still not writing manual SQL queries. read_project_for_iids is used
by read_issue_iid and read_merge_request_iid to satisfy both of those
constraints, and allow the declarative policy runner to use its normal caching
strategy.