Don't allow U2F set up unless an authenticator app is set up

Closes #17333 

# TODO

- [ ]  #17333 Authenticator should be set up before enabling U2F
    - [x]  Implementation
    - [x]  Fix/add tests
    - [x]  Refactor
    - [x]  Wait for [build](https://gitlab.com/gitlab-org/gitlab-ce/commit/964c98a3c427cac6e3de88ddc74a9f172ee9742d/builds) to pass
    - [x]  Assign to endboss for review
    - [x]  Address @DouweM's comments
        - [x]  No need for `javascript:void(0)`
        - [x]  Add screenshots
    - [ ]  Wait for merge

# Screenshots

![Screen_Shot_2016-06-15_at_8.18.03_AM](/uploads/26531fa7f6e5d7617fd11d1779021b4f/Screen_Shot_2016-06-15_at_8.18.03_AM.png)
![Screen_Shot_2016-06-15_at_8.18.37_AM](/uploads/ceaae97a987a15d3e04dd76aa8a944bd/Screen_Shot_2016-06-15_at_8.18.37_AM.png)
![Screen_Shot_2016-06-15_at_8.18.47_AM](/uploads/394224d5fcff759d5acc3bf39a138530/Screen_Shot_2016-06-15_at_8.18.47_AM.png)

See merge request !4585

Resolve "Track the number of new Redis connections per transaction"

## What does this MR do?

Add a new metric counter, `new_redis_connections`, that contains the number of calls to `Redis::Client#connect` in the current transaction.

## Are there points in the code the reviewer needs to double check?

Not sure. I tested this in kind of a brute-force way:

1. Add a debugger in the monkey-patched `connect` method.
2. With metrics enabled, start the app and load a page.
3. The first Redis connection is created by `Rack::Attack` and isn't in a transaction, but still works fine.
4. The second Redis connection is within a transaction (the page load), and increments the counter.
5. If I reload the page, neither debugger is hit.
6. If I use a Redis client and do `CLIENT KILL` on my two existing clients, then reload the page, I get 3 and 4 again.
7. If I disable metrics collection, the debugger never gets hit.

## Why was this MR needed?

We may have a Redis connection leak somewhere, so adding metrics will let us track this.

## What are the relevant issue numbers?

Closes #18451.

## Screenshots (if relevant)

Hahaha nope, not relevant.

## Does this MR meet the acceptance criteria?

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- [ ] Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [ ] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [ ] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

cc @yorickpeterse 

See merge request !4649

Add docs for assigning labels/milestone when moving issue

Extends https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3934

See merge request !4069

[ci skip]

Document CI_BUILD_TOKEN

## What does this MR do?

Adds `CI_BUILD_TOKEN` to CI variables documentation.


See merge request !4664

Include user relationship when retrieving award_emoji

See merge request !4647

Avoiding N+1 when showing grouped awards and when 
calculating participants for awardable entities

Don't fail builds for projects that are deleted when they are stuck

## What does this MR do?

Solves when dropping stuck connection.
```
Dropping stuck pending build 1545510 for runner 
NoMethodError: undefined method `origin_merge_requests' for nil:NilClass
    from /opt/gitlab/embedded/service/gitlab-rails/app/services/merge_requests/base_service.rb:50:in `merge_request_from'
    from /opt/gitlab/embedded/service/gitlab-rails/app/services/merge_requests/base_service.rb:57:in `each_merge_request'
    from /opt/gitlab/embedded/service/gitlab-rails/app/services/merge_requests/add_todo_when_build_fails_service.rb:5:in `execute'
    from /opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/metrics/instrumentation.rb:164:in `execute'
    from /opt/gitlab/embedded/service/gitlab-rails/app/models/commit_status.rb:51:in `block (2 levels) in <class:CommitStatus>'
    from /opt/gitlab/embedded/service/gem/ruby/2.1.0/gems/state_machines-0.4.0/lib/state_machines/eval_helpers.rb:79:in `call'
...
```

This happens, because that `default_scope` of `Projects` filters returns the projects that are not deleted, where `Ci::Build` doesn't take into account.


See merge request !4609

- We added a `current_user.two_factor_via_otp?` check to the view. When
  rendering the view via the teaspoon fixture, `current_user` is `nil`.

- Also change the help message to indicate that an authenticator app is
  now a prerequisite for U2F.

Fix typo in obtaining a backtrace from all threads in gdb



See merge request !4612

Fix note polling when a window has been hidden

`refresh` was called, `refreshing` was set to true, but then because
`document.hidden` was true, `getContent` was never called, and
`refreshing` never got reset to `false`, which stopped polling entirely
until refresh.

See merge request !4635

Manually create todo for issuable

## What does this MR do?

Adds a button to the sidebar in issues & merge requests to allow users to manually create a todo item themselves.

## What are the relevant issue numbers?

Closes #15045 

## Screenshots (if relevant)

![Screen_Shot_2016-06-07_at_09.52.14](/uploads/00af70244c0589d19f241c3e85f3d63d/Screen_Shot_2016-06-07_at_09.52.14.png)

![Screen_Shot_2016-06-07_at_09.52.06](/uploads/e232b02208613a4a50cff4d1e6f119ff/Screen_Shot_2016-06-07_at_09.52.06.png)

![Screen_Shot_2016-06-07_at_09.51.14](/uploads/f1d36435d49ab882538ae2252bec8086/Screen_Shot_2016-06-07_at_09.51.14.png)

See merge request !4502

Only show notes through JSON on confidential issues that the user has access to

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/18535

See merge request !1970

Update CHANGELOG

## What does this MR do?
Updates the CHANGELOG


See merge request !4549

Fixes bulk-assign labels not working when navigating through pages

## What does this MR do?
This MR fixes an issue on bulk-assign labels not working when navigating though pages. The functionality was not working because events on checkboxes weren't working. This re-runs `Issuable.initChecks()` and makes sure we are not leaving zombie event handlers by turning them off first.

Also fixes tests to use `wait_for_ajax` since label filtering is now using `Turbolinks` for redirection.

## Does this MR meet the acceptance criteria?

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- [ ] Tests
  - [ ] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !4632

Aligned the two navs horizontally

## What does this MR do?

Previously the 2 top navs were not aligned horizontally together. The top nav would be slightly to the left due to the settings dropdown. This corrects that by putting `position: absolute` on the dropdown toggle.

## What are the relevant issue numbers?

Closes #18513 

## Screenshots (if relevant)

![Screen_Shot_2016-06-13_at_10.20.22](/uploads/46f39a84dde74707578970f70ddda511/Screen_Shot_2016-06-13_at_10.20.22.png)

See merge request !4616

Update allocations Gem & ignore classes without names

## What does this MR do?

1. Updates the allocations Gem to 1.0.5 so it can be used on 2.2/2.3 without crashing
2. Changes the background sampler to ignore classes/modules without a name (as we can't do much with these)

## Are there points in the code the reviewer needs to double check?

No.

## Why was this MR needed?

Using MRI 2.2 or 2.3 would lead to a segmentation fault in the allocations Gem, sometimes this problem would also occur on 2.1

## What are the relevant issue numbers?

Not an issue, but the merge request that highlighted these problems: !3807

## Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] ~~[Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)~~
- [ ] ~~API support added~~
- [ ] Tests
  - [x] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [ ] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !4645

Uses outerWidth instead of width

Revert "Added API endpoint for Sidekiq Metrics"

@DouweM please merge my accidental push to master.

See merge request !4651

This reverts commit 06e0ef07

We can't do a lot with classes without names as we can't filter by them,
have no idea where they come from, etc. As such it's best to just ignore
these.

This allows it to be used on Ruby 2.3 without it crashing all the time.

Put all sidebar icons in fixed width container

## What does this MR do?
Puts all icons (font awesome and custom) in fixed width container to fix weird alignment

## Why was this MR needed?
Mix of font awesome icons & custom icons results in different icon widths

## What are the relevant issue numbers?
Closes #18539 

## Screenshots (if relevant)
<img src="/uploads/94a82258d5d71df0b9608ccd4d7e5cd1/Screen_Shot_2016-06-14_at_9.57.25_AM.png" width="400px">



See merge request !4648

Increment the counter `new_redis_connections` on each call to
`Redis::Client#connect`, if we're in a transaction.

Forbid scripting for wiki files

Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.

Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.

See merge request !1969