CE upstream - Wednesday

Closes gitlab-ce#39732, gitlab-ce#39798, gitlab-ce#38372 et gitlab-ce#39377

See merge request gitlab-org/gitlab-ee!3308

Backport 10.1.2 security fixes to master

See merge request gitlab-org/gitlab-ee!3318

Include standard JWT claims in Geo JWTs [10.1]

See merge request gitlab/gitlab-ee!554

(cherry picked from commit 676a194bf27facbb431abf6e9fa57ea6ad29af42)

f2e5dee8 Include standard JWT claims in Geo JWTs

Document securing Geo database replication with SSL

Closes #1745

See merge request gitlab-org/gitlab-ee!3284

Fix example request in jobs API docs

Closes gitlab-ce#39901

See merge request gitlab-org/gitlab-ee!3314

Fix TRIGGER checks for MySQL

Closes #38372

See merge request gitlab-org/gitlab-ce!15226

Add documentation for retrieving Geo nodes and status via API

See merge request gitlab-org/gitlab-ee!3304

Signed-off-by: Rémy Coutable <remy@rymai.me>

Signed-off-by: Rémy Coutable <remy@rymai.me>

EE: Rewrite the GitHub importer to perform work in parallel and greatly improve performance

Closes gitlab-ce#39361

See merge request gitlab-org/gitlab-ee!3310

Geo: Fix handling of nil/zero values in admin screen

See merge request gitlab-org/gitlab-ee!3301

Signed-off-by: Rémy Coutable <remy@rymai.me>

[EE] Use Commit#notes and Note.for_commit_id when possible to make sure we use all indexes available to us

See merge request gitlab-org/gitlab-ee!3311

Update Geo replication setup docs for Omnibus installation

Closes #3955

See merge request gitlab-org/gitlab-ee!3313

[EE] Fix Error 500 when pushing LFS objects with a write deploy key

See merge request gitlab-org/gitlab-ee!3306

Does not move projects backed by hashed storage when handling renamed events

Closes #3508

See merge request gitlab-org/gitlab-ee!3066

Port of 38395-mr-widget-ci to EE

See merge request gitlab-org/gitlab-ee!3296

Use Commit#notes and Note.for_commit_id when possible to make sure we use all the indexes available to us

[ci skip]

Prior to this MR there were two GitHub related importers:

* Github::Import: the main importer used for GitHub projects
* Gitlab::GithubImport: importer that's somewhat confusingly used for
  importing Gitea projects (apparently they have a compatible API)

This MR renames the Gitea importer to Gitlab::LegacyGithubImport and
introduces a new GitHub importer in the Gitlab::GithubImport namespace.
This new GitHub importer uses Sidekiq for importing multiple resources
in parallel, though it also has the ability to import data sequentially
should this be necessary.

The new code is spread across the following directories:

* lib/gitlab/github_import: this directory contains most of the importer
  code such as the classes used for importing resources.
* app/workers/gitlab/github_import: this directory contains the Sidekiq
  workers, most of which simply use the code from the directory above.
* app/workers/concerns/gitlab/github_import: this directory provides a
  few modules that are included in every GitHub importer worker.

== Stages

The import work is divided into separate stages, with each stage
importing a specific set of data. Stages will schedule the work that
needs to be performed, followed by scheduling a job for the
"AdvanceStageWorker" worker. This worker will periodically check if all
work is completed and schedule the next stage if this is the case. If
work is not yet completed this worker will reschedule itself.

Using this approach we don't have to block threads by calling `sleep()`,
as doing so for large projects could block the thread from doing any
work for many hours.

== Retrying Work

Workers will reschedule themselves whenever necessary. For example,
hitting the GitHub API's rate limit will result in jobs rescheduling
themselves. These jobs are not processed until the rate limit has been
reset.

== User Lookups

Part of the importing process involves looking up user details in the
GitHub API so we can map them to GitLab users. The old importer used
an in-memory cache, but this obviously doesn't work when the work is
spread across different threads.

The new importer uses a Redis cache and makes sure we only perform
API/database calls if absolutely necessary.  Frequently used keys are
refreshed, and lookup misses are also cached; removing the need for
performing API/database calls if we know we don't have the data we're
looking for.

== Performance & Models

The new importer in various places uses raw INSERT statements (as
generated by `Gitlab::Database.bulk_insert`) instead of using Rails
models. This allows us to bypass any validations and callbacks,
drastically reducing the number of SQL queries and Gitaly RPC calls
necessary to import projects.

To ensure the code produces valid data the corresponding tests check if
the produced rows are valid according to the model validation rules.

The GitHub importer (and probably other parts of our code) ends up
calling Feature.persisted? many times (via Gitaly). By storing this data
in RequestStore we can save ourselves _a lot_ of database queries.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/39361

This adds the keyword argument "return_ids" to
Gitlab::Database.bulk_insert. When set to `true` (and PostgreSQL is
used) this method will return an Array of the IDs of the inserted rows,
otherwise it will return an empty Array.

By using SQL::Union we can return a proper ActiveRecord::Relation,
making it possible to select the columns we're interested in (instead of
all of them).