Fix using wildcards in protected tags to expose protected variables

[10.4] Fix GH namespace security issue

Restrict Todo API mark_as_done endpoint to the user's todos only

Restrict LDAP API to admins only - 10.4 port

[10.4] Fix stored XSS in code blocks

Merge branch 'security-10-4-25223-snippets-finder-doesnt-obey-feature-visibility' into 'security-10-4'

[Port for security-10-4]: Makes SnippetFinder ensure feature visibility

CE upstream - 2018-02-09 18:24 UTC

Closes gitlab-qa#180

See merge request gitlab-org/gitlab-ee!4471

Improve docs about allowing some side effects on the constructor

See merge request gitlab-org/gitlab-ce!17027

Add documentation on how to build a QA Docker image

See merge request gitlab-org/gitlab-ce!17036

Resolve "Update SAST doc and example"

Closes #4845

See merge request gitlab-org/gitlab-ee!4426

Fix incorrect role name in mirroring error

See merge request gitlab-org/gitlab-ee!4468

Resolve "EE-only js for project edit page"

Closes #4610

See merge request gitlab-org/gitlab-ee!4135

Do not attach runner to a non-exsiting network in QA

Closes gitlab-qa#180

See merge request gitlab-org/gitlab-ce!17028

CE upstream - 2018-02-09 00:24 UTC

Closes gitlab-qa#180

See merge request gitlab-org/gitlab-ee!4460

Allow using a different sandbox group for QA

See merge request gitlab-org/gitlab-ce!17000

Moves missing branch into a vue file

See merge request gitlab-org/gitlab-ce!17016

Replace $.post in importer status with axios

See merge request gitlab-org/gitlab-ce!16692

Update vue component naming guidelines

See merge request gitlab-org/gitlab-ce!17018

* upstream/master: (27 commits)
  Set initial password for instance in LDAP QA test
  Backport EE changes to some hashed storage documentation to CE
  Remove allow_n_plus_1 from Git::Repository#branches_filter
  Bumps Gitlab Shell version to 6.0.3
  Make resetting column information overridable in EE
  Added 'clear' button to ci lint editor
  Issues and merge requests in subgroups docs
  Update docs labels CE
  Refactored merge_requests/show path in dispatcher.js
  wording
  don't check against a hardcoded user name
  10.5 Update the dependencies license list
  10.5 Update the .gitignore, .gitlab-ci.yml, and Dockerfile templates
  Create update guide for 10.5
  Update 10.5 source install guide
  Add docs for MR link in commit page
  Add groups to OpenID Connect claims
  Replaced $.get with axois.get
  Memoize MergeRequest#rebase_in_progress? to prevent N+1 queries in Gitaly
  [docs] Info rescheduling background migrations
  ...

Set initial password for instance in LDAP QA test

See merge request gitlab-org/gitlab-ce!17024

Resolve "Failing spec: Pipeline Quota with no quota shows correct group quota info"

Closes #4858

See merge request gitlab-org/gitlab-ee!4453

Move All Geo Sidekiq workers to geo namespace

Closes #4868

See merge request gitlab-org/gitlab-ee!4459

Resolve "Hashed storage is now beta"

Closes #42896

See merge request gitlab-org/gitlab-ce!17015

For a new instance, the root password needs to be set, regardless of whether
LDAP is enabled.