CE upstream



See merge request !517

Support Kerberos SPNEGO in GitHttpController

Fixes https://gitlab.com/gitlab-org/gitlab-ee/issues/734

Should merge cleanly with CE because of https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5037

See merge request !509

Fix of quoted text in lock tooltip



See merge request !518

Add Todos API

* Closes #14068
* Closes #14675 

- [x] Implementation
- [x]  Tests
- [x] Documentation
- [x] Changelog

See merge request !3188

Fixing problems with events for import/export

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/19202

A couple of issues related to target being missing in exported `Events` (as being polymorphic and not have `ActiveRecord` relationships is a bit more tricky than normal models) plus as the export was in JSON, the import retrieves hashed fields as stringified hashes and not symbolized - so fixed that as well, which was the cause of https://gitlab.com/gitlab-org/gitlab-ce/issues/19202

Also fixed / refactored tests
:simpl
Import/Export Version has been bumped to 0.1.1 as theses changes to events won't work very well with old exports - forcing users to generate a new export in the new version.

See merge request !4987

Upgrade sprockets and sprockets rails, remove quiet_assets

## What does this MR do?

Upgrade Sprockets from 3.6.0 to 3.6.2.

Changelog: https://github.com/rails/sprockets/blob/3.x/CHANGELOG.md

Upgrade Sprockets Rails from 3.0.4 to 3.1.1.

Changelog: https://github.com/rails/sprockets-rails/compare/v3.0.4...v3.1.1

quiet_assets has been seemingly abandoned, and now sprockets-rails has the feature built-in!

The config was added in this PR: https://github.com/rails/sprockets-rails/pull/355

Working towards #14286.

See merge request !5029

Ensure that branch and tag names are given in API

## What does this MR do?

It ensures that the tag or branch name is given. @rymai We talked in an earlier MR about this.

See merge request !5012

Moved weight under labels

## What does this MR do?

Moves the 'weight' input under the 'labels' input on issuable creation forms.

## Are there points in the code the reviewer needs to double check?

Is this the only place this is required?

## Why was this MR needed?

UX.

## What are the relevant issue numbers?

Closes #735.

## Screenshots (if relevant)

![Screen_Shot_2016-06-28_at_23.11.33](/uploads/e2a460ed872b50ef9553b4b4e491f98d/Screen_Shot_2016-06-28_at_23.11.33.png)

## Does this MR meet the acceptance criteria?

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !505

Cache autocomplete results

## What does this MR do?

Caches the results of the autocomplete AJAX call to stop new GFM inputs on the page from requesting new data. The cache is then cleared on each new page so that it doesn't stay around per project.

See merge request !5043

Improve the request / withdraw access button

## What does this MR do?

It implements the design proposed in #18310.

## Are there points in the code the reviewer needs to double check?

No.

## Why was this MR needed?

To close #18310.

## What are the relevant issue numbers?

Closes #18310.

## Screenshots

### Group access request

#### Request button

| Medium | Large |
| ----------- | ------- |
| ![request_access_button](/uploads/a1de370dcbb8ac9a63d2df5c68591db7/request_access_button.png) | ![request_access_button-large](/uploads/0a1c70380268e620a6ca4d3e1661d58c/request_access_button-large.png) |

#### Withdraw request button

| Medium | Large |
| ----------- | ------- |
| ![withdraw_access_request_button](/uploads/c9df39d04b61566ec143d5e9cc43ada2/withdraw_access_request_button.png) | ![withdraw_access_request_button-large](/uploads/10fdaa94d72956e06bdb995e65b51472/withdraw_access_request_button-large.png) |

### Project access request

#### Request button

| Medium | Large |
| ----------- | ------- |
| ![request_access_button](/uploads/8e71395041a5cea996a35df2083bb723/request_access_button.png) | ![project-request_access_button-large](/uploads/adb2dec0eccec8e5171dc0e26e6b03a6/project-request_access_button-large.png) |

#### Withdraw request button

| Medium | Large |
| ----------- | ------- |
| ![withdraw_access_request_button](/uploads/12be06f0a2bf9426a5e043f52c4d1dab/withdraw_access_request_button.png) | ![project-withdraw_access_request_button-large](/uploads/93fda7767ee5f02186c4c954ea346254/project-withdraw_access_request_button-large.png) |

## Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [x] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- Tests
  - [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !4860

Specific metrics for code on Banzai::Filter::SyntaxHighlightFilter

See merge request !5038

Signed-off-by: Rémy Coutable <remy@rymai.me>

Merge remote-tracking branch 'jvgl-ce/git-http-kerberos-ce' into kerberos-spnego-git-http-controller

Admin should be able to turn shared runners into specific ones:

## What does this MR do?

Make sure admins could turn shared runners into specific runners.

## Are there points in the code the reviewer needs to double check?

Is this the desired behaviour?

## Why was this MR needed?

Closes #19039
Closes #19272

![Screen_Shot_2016-06-30_at_9.30.05_PM](/uploads/97eb3b4923fd4e498b1f8ca70b1345c8/Screen_Shot_2016-06-30_at_9.30.05_PM.png)

See merge request !4961

Avoid instantiation of a Git::Tree

See merge request !4997

* upstream/master: (120 commits)
  Update CHANGELOG for 8.9.4, 8.8.7, and 8.7.9.
  Remove additional entries from CHANGELOG
  Catch permission denied errors and ignore the disk
  Remove coveralls lines
  Make GH one-off auth the default again for importing GH projects
  Import from Github using Personal Access Tokens.
  Remove hardcoded gitlab-shell version in test env now that the required tag is published
  Updated breakpoint for sidebar pinning
  Expire branch/tag git data when needed.
  Remove unnecessary parens
  Enable Style/UnneededCapitalW Rubocop cop
  Expiry date on pinned nav cookie
  Fix broken spec in git_push_service_spec by stubbing an external issue tracker
  Handle external issues in IssueReferenceFilter
  Move Changelog entry for build retry fix to 8.9.4
  Add Changelog entry for build sidebar retry link fix
  Improve method that tells if build is retryable
  Do not show build retry link when build is active
  Remove coveralls as its unused
  Move changelot item "Add sub nav to file page view" to 8.9.4
  ...