Signed-off-by: NRémy Coutable <remy@rymai.me>

Updates specs to use new rails5 format.

The old format:
`get :show, { some: params }, { some: headers }`

The new format:
`get :show, params: { some: params }, headers: { some: headers }`

Rename Projects::ReleasesController to
Projects::Tags::ReleasesController

Previously, the GitHub importer would only work if the site configured
an OAuth2 provider were configured. Users attempting to import via a
GitHub personal access token would see an Error 500 due to a failed
redirection. We fix this by only doing the redirection if the provider
has been configured and allowing users to see the new import page.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/38524

Before a 404 would be rendered only after a request to Gitaly would
return with an InvalidArgument error. Now we check that the ref have a
valid format before sending it to Gitaly. In both cases, a 404 is
returned to the user, but this change prevents Gitaly from generating
error noise in production.

Closes https://gitlab.com/gitlab-org/gitaly/issues/1425

When a project is forked, the new repository used to be a deep copy of everything
stored on disk by leveraging `git clone`. This works well, and makes isolation
between repository easy. However, the clone is at the start 100% the same as the
origin repository. And in the case of the objects in the object directory, this
is almost always going to be a lot of duplication.

Object Pools are a way to create a third repository that essentially only exists
for its 'objects' subdirectory. This third repository's object directory will be
set as alternate location for objects. This means that in the case an object is
missing in the local repository, git will look in another location. This other
location is the object pool repository.

When Git performs garbage collection, it's smart enough to check the
alternate location. When objects are duplicated, it will allow git to
throw one copy away. This copy is on the local repository, where to pool
remains as is.

These pools have an origin location, which for now will always be a
repository that itself is not a fork. When the root of a fork network is
forked by a user, the fork still clones the full repository. Async, the
pool repository will be created.

Either one of these processes can be done earlier than the other. To
handle this race condition, the Join ObjectPool operation is
idempotent. Given its idempotent, we can schedule it twice, with the
same effect.

To accommodate the holding of state two migrations have been added.
1. Added a state column to the pool_repositories column. This column is
managed by the state machine, allowing for hooks on transitions.
2. pool_repositories now has a source_project_id. This column in
convenient to have for multiple reasons: it has a unique index allowing
the database to handle race conditions when creating a new record. Also,
it's nice to know who the host is. As that's a short link to the fork
networks root.

Object pools are only available for public project, which use hashed
storage and when forking from the root of the fork network. (That is,
the project being forked from itself isn't a fork)

In this commit message I use both ObjectPool and Pool repositories,
which are alike, but different from each other. ObjectPool refers to
whatever is on the disk stored and managed by Gitaly. PoolRepository is
the record in the database.

- Fixes multiple hooks within the same group
- Omits the default 'each'

- Updates tests / applies patterns per MR feedback

This reverts commit 3560b119.

This changes `correlation_id` to be `correlation-id` when passed via jobs

The Correlation ID is taken or generated from received X-Request-ID.
Then it is being passed to all executed services (sidekiq workers
or gitaly calls).

The Correlation ID is logged in all structured logs as `correlation_id`.

Also, the error message became shorter.

- Adjusts behavior to cover conditional trigger variable values

We already had a flag to use a CTE, but this broke searching in some
cases where we need to sort by a joined table. Disabling the CTE flag
makes searches much slower.

The new flag, to use a subquery, makes them slightly slower than the
CTE, while maintaining correctness. If both it and the CTE flag are
enabled, the subquery takes precedence.

Adds gitlab.impersonation_enabled config option defaulting to true to
keep the current default behaviour.

Only the act of impersonation is modified, impersonation token
management is not affected.

In EE we redefine Environment#terminals, which makes it impossible to
use `allow_any_instance_of(Environment)` or
`expect_any_instance_of(Environment)`. Other approaches of stubbing
this class, such as by stubbing `new`, only result in spec failures.

To solve this issue, we add a simple `defined?(EE)` check in the tests
to change the thing that we are testing. This is rather obnoxious,
because it requires EE knowledge in CE, and can break if
`EE::Environment` is removed without updating CE. Unfortunately, it
appears to be the only solution we have apart from modifying these tests
in EE (which would cause merge conflicts).

Fix deprecation: render :text is deprecated because it does not actually render a text/plain response

[master] Resolve "Reflected XSS in OAuth Authorize window due to redirect_uri allowing arbitrary protocols"

See merge request gitlab/gitlabhq!2572

[master] Resolve "Personal access token with only `read_user` scope can be used to authenticate any web request"

See merge request gitlab/gitlabhq!2583

[master]Fixed ability to comment on and edit/delete comments on locked or confidential issues

See merge request gitlab/gitlabhq!2612

[master] Resolve: Promoting a milestone is missing an authorization check

See merge request gitlab/gitlabhq!2598