Fix private feature Elasticsearch leak

Closes gitlab-ee#381

See merge request gitlab/gitlabhq!3457

[ci skip]

Add spec to test different combinations.

Add spec

If the request wasn't initiated by gitlab we shouldn't add the new
identity to the user, and instead show that we weren't able to link
the identity to the user.

This should fix: https://gitlab.com/gitlab-org/gitlab-ce/issues/56509

If user unsubsrcribes from a resource that they no longer have
access to they should not be revealed the resource path, but be
redirected to app root instead.

https://gitlab.com/gitlab-org/gitlab-ce/issues/64938

This prevents a MITM attack where attacker could
still access Git repository if any jobs were
running long enough.

Fix rubocop offences and add changelog

Add email_verified key for feature specs

Add code review remarks

Add code review remarks

Fix specs

Label events may use cross-project or cross-group references,
if the projects are not accessible by user, we don't show these
label events.

[ci skip]

[ci skip]

[ci skip]