Check that SAML identity linking validates the origin of the request

See merge request gitlab/gitlabhq!3396

Only render fixed number of mermaid blocks

See merge request gitlab/gitlabhq!3411

Merge branch 'security-12717-fix-confidential-issue-assignee-visible-to-guests-12-3' into '12-3-stable'

Display only participants that user has permission to see

See merge request gitlab/gitlabhq!3421

Redirect user to root path after unsubscribing from private resource

See merge request gitlab/gitlabhq!3423

Hide disabled project milestones in project settings on group level

See merge request gitlab/gitlabhq!3424

Add policy check if cross reference system notes are accessible

See merge request gitlab/gitlabhq!3426

Cancel all running CI jobs when user is blocked

See merge request gitlab/gitlabhq!3436

Filter not accessible label events

See merge request gitlab/gitlabhq!3440

Label events may use cross-project or cross-group references,
if the projects are not accessible by user, we don't show these
label events.

[ci skip]

This prevents a MITM attack where attacker could
still access Git repository if any jobs were
running long enough.

If user unsubsrcribes from a resource that they no longer have
access to they should not be revealed the resource path, but be
redirected to app root instead.

https://gitlab.com/gitlab-org/gitlab-ce/issues/64938

[ci skip]

If the request wasn't initiated by gitlab we shouldn't add the new
identity to the user, and instead show that we weren't able to link
the identity to the user.

This should fix: https://gitlab.com/gitlab-org/gitlab-ce/issues/56509

[ci skip]

[ci skip]