This reverts merge request !10845

TodoService should not call `.select(&:id)` on todos, because this is
bad performance. So instead use sub-queries, which will result in a
single SQL query to the database.

https://docs.gitlab.com/ee/development/sql.html#plucking-ids

- Currently, (for example) admins can't delete snippets for blocked users, which
  is an unexpected limitation.

- We modify `authenticate!` to conduct the `access_api` policy check against the
  `initial_current_user`, instead of the user being impersonated.

- Update CHANGELOG for !10842

- To prevent an attacker from enumerating the `/users` API to get a list of all
  the admins.

- Display the `is_admin?` flag wherever we display the `private_token` - at the
  moment, there are two instances:

  - When an admin uses `sudo` to view the `/user` endpoint
  - When logging in using the `/session` endpoint

When updating a merge request via the `/merge` endpoint we
check the `mergeable` and `mergeable_state` status, these will return
`false` if the application option only_allow_merge_if_pipeline_succeeds is
enabled. We should skip CI checks if the request uses the
merge_when_pipeline_succeeds param

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/22740

Signed-off-by: NRémy Coutable <remy@rymai.me>

CE port of https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/962

Refactored specs and added a post deployment migration to remove the activity users table.

It uses a user activity table instead of a column in users.
Tested with mySQL and postgreSQL

When renaming, the argument on the projects hook API was forgotten. Now
one could successfully set it again.

The fix is a little ugly stylewise, but needed as the underlying model
still refers to it as build_events. This commit is to fix it, later we
should migrate the data to a new column. The edit on the spec file makes
sure it passes now, and will fail when we migrate the column.

Signed-off-by: NRémy Coutable <remy@rymai.me>

Extended ProjectFinder in order to handle the following options:
 - current_user - which user use
 - project_ids_relation: int[] - project ids to use
 - params:
   -  trending: boolean
   -  non_public: boolean
   -  starred: boolean
   -  sort: string
   -  visibility_level: int
   -  tags: string[]
   -  personal: boolean
   -  search: string
   -  non_archived: boolean

GroupProjectsFinder now inherits from ProjectsFinder.
Changed the code in order to use the new available options.

Notice that this param is being supported since V3, but we have not added the proper docs for it

* Documentation was incorrectly advertising the missing param

The MergeRequestsFinder uses the milestone_title instead of the
milestone_id

Implement module for setting "Poll-Interval" response header.
Return 429 in ETag caching middleware when polling is disabled.

These changes are ported over from
https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/1502 to reduce
the number of merge conflicts that may occur.