Sanitize the return_to param to avoid XSS.
Update sprite icon markup to be up to HTML standard

Changelog: security
EE: true

Fix DB load balance autoloading/code-reloading

See merge request gitlab-org/gitlab!71218

Send setup_for_company to CustomersDot in trial form

See merge request gitlab-org/gitlab!70569

Use validated URL when sending request to Gitea Importer

See merge request gitlab-org/security/gitlab!1758

Security: 2FA bypass using git command

See merge request gitlab-org/security/gitlab!1739

Apply account locking to password reset page

See merge request gitlab-org/security/gitlab!1702

Enforce configured scopes for OAuth applications

See merge request gitlab-org/security/gitlab!1708

Project access tokens can be used as "back doors"

See merge request gitlab-org/security/gitlab!1749

Do not export and import repository_size_limit

See merge request gitlab-org/security/gitlab!1753

Users with expired password can still access API and Git with token

See merge request gitlab-org/security/gitlab!1690

Disable exporting pipeline triggers on project export

See merge request gitlab-org/security/gitlab!1752

Verify state before using errors from OAuth2 OmniAuth providers

See merge request gitlab-org/security/gitlab!1731

Prevent showing not allowed subgroup epics

See merge request gitlab-org/security/gitlab!1635

Add pagination to Dependencies API

See merge request gitlab-org/security/gitlab!1679

Escapes MR approval rule names correctly

See merge request gitlab-org/security/gitlab!1760

Prevent moving epic issues to different group hierarchy

See merge request gitlab-org/security/gitlab!1626

Merge branch 'security-pending-invitations-of-public-groups-and-public-projects-are-visible-to-any-user' into 'master'

Require group admin access to list pending invites

See merge request gitlab-org/security/gitlab!1714

Fix denial-of-service attack in Markdown parser

See merge request gitlab-org/security/gitlab!1696

Fix stored XSS in GFM auto-complete

See merge request gitlab-org/security/gitlab!1703

Changelog: changed

Fix Jira connect events controller spec indentation

See merge request gitlab-org/gitlab!70940

Scrub artifacts signed URL in SendEntry logs

See merge request gitlab-org/security/gitlab!1837

Docs: Improve cluster levels sections

See merge request gitlab-org/gitlab!71209

Update error tracking docs with more UI

See merge request gitlab-org/gitlab!70803

Skip Product Intelligence review for growth experiments MRs

See merge request gitlab-org/gitlab!70907

Fix GKE IAC instructions

See merge request gitlab-org/gitlab!70433

[Geo] Add a worker to backfill verification state

See merge request gitlab-org/gitlab!69301

Add Project Migration Labels

See merge request gitlab-org/gitlab!70810

Make Import Metrics project_counter private

See merge request gitlab-org/gitlab!71114

Use GroupTree ancestors linear scopes

See merge request gitlab-org/gitlab!70503

Add md5_hexdigest to compute MD5 hashes for files

See merge request gitlab-org/gitlab!71178

Clean up vale substitution warnings MR1

See merge request gitlab-org/gitlab!71025

Stop using view helpers in Clusters::ClusterPresenter

See merge request gitlab-org/gitlab!70867