Fix using wildcards in protected tags to expose protected variables

[10.4] Fix GH namespace security issue

Restrict Todo API mark_as_done endpoint to the user's todos only

[10.4] Fix stored XSS in code blocks

Merge branch 'security-10-4-25223-snippets-finder-doesnt-obey-feature-visibility' into 'security-10-4'

[Port for security-10-4]: Makes SnippetFinder ensure feature visibility

Improve docs about allowing some side effects on the constructor

See merge request gitlab-org/gitlab-ce!17027

Add documentation on how to build a QA Docker image

See merge request gitlab-org/gitlab-ce!17036

Do not attach runner to a non-exsiting network in QA

Closes gitlab-qa#180

See merge request gitlab-org/gitlab-ce!17028

Allow using a different sandbox group for QA

See merge request gitlab-org/gitlab-ce!17000

Moves missing branch into a vue file

See merge request gitlab-org/gitlab-ce!17016

Replace $.post in importer status with axios

See merge request gitlab-org/gitlab-ce!16692

Update vue component naming guidelines

See merge request gitlab-org/gitlab-ce!17018

* upstream/master: (27 commits)
  Set initial password for instance in LDAP QA test
  Backport EE changes to some hashed storage documentation to CE
  Remove allow_n_plus_1 from Git::Repository#branches_filter
  Bumps Gitlab Shell version to 6.0.3
  Make resetting column information overridable in EE
  Added 'clear' button to ci lint editor
  Issues and merge requests in subgroups docs
  Update docs labels CE
  Refactored merge_requests/show path in dispatcher.js
  wording
  don't check against a hardcoded user name
  10.5 Update the dependencies license list
  10.5 Update the .gitignore, .gitlab-ci.yml, and Dockerfile templates
  Create update guide for 10.5
  Update 10.5 source install guide
  Add docs for MR link in commit page
  Add groups to OpenID Connect claims
  Replaced $.get with axois.get
  Memoize MergeRequest#rebase_in_progress? to prevent N+1 queries in Gitaly
  [docs] Info rescheduling background migrations
  ...

Set initial password for instance in LDAP QA test

See merge request gitlab-org/gitlab-ce!17024

Resolve "Hashed storage is now beta"

Closes #42896

See merge request gitlab-org/gitlab-ce!17015

For a new instance, the root password needs to be set, regardless of whether
LDAP is enabled.

Remove allow_n_plus_1 from Git::Repository#branches_filter

See merge request gitlab-org/gitlab-ce!17012

Use hashed storage in the specs

Closes #40744

See merge request gitlab-org/gitlab-ce!15681

Make resetting column information overridable in EE

See merge request gitlab-org/gitlab-ce!17007

Bumps Gitlab Shell version to 6.0.3

See merge request gitlab-org/gitlab-ce!17008

Added 'clear' button to ci lint editor

Closes #26598 and #41209

See merge request gitlab-org/gitlab-ce!16970

Add docs for MR link in commit page

See merge request gitlab-org/gitlab-ce!16994

Resolve 10.5.0 RC1 QA Failure with failing API specs

Closes gitlab-qa#180

See merge request gitlab-org/gitlab-ce!16999

Issues and merge requests in subgroups docs

See merge request gitlab-org/gitlab-ce!16978