* Use gl_id when we don't know if it's a key-X or user-X
* Use Actor.new_from(gl_id) which will figure out if it's a Key or User
* Use key_str when we're referring to key-X as key_id is confusing

Release GitLab Shell v8.0.0

See merge request gitlab-org/gitlab-shell!218

Add support for ssh certificates

Closes gitlab-ce#34572

See merge request gitlab-org/gitlab-shell!207

- Is possible that gl_id could be a 'user_id'
- Is a more accurate variable name

* Move gitaly, git-lfs and 2FA logic out from gitlab_shell.rb
* Streamline parsing of origin_cmd in GitlabShell
* Utilise proper HTTP status codes sent from the API
* Also support 200 OK with status of true/false (ideally get rid of this)
* Use HTTP status constants
* Use attr_reader definitions (var over @var)
* Rspec deprecation fixes

* Use constants for git commands
* private instead of protected

* Remove HTTP related requires
* Make protocol = GL_PROTOCOL the default

* Rename actor to key_id
* protected to private
* Move attr_reader defintions under private

* Base - contains all common logic
* Gitaly - performs interactions with Gitaly
* API2FARecovery - 2FA recovery code generation
* GitLFSAuthenticate - git-lfs authentication

* Fix lib matcher so it actually runs specs
* Strip out only what we need/use

Update gitaly-proto to 0.109.0

See merge request gitlab-org/gitlab-shell!216

This along with the code submitted to gitlab-ce in the
gitlab-org/gitlab-ce! MR implements SSH certificate
authentication. See the docs added to gitlab-ce for why and how to
enable this. This, along with that MR, closes
gitlab-org/gitlab-ce#3457

Implementation notes:

 - Because it's easy to do, and because an earlier nascent version of
   this would pass user-ID to gitlab-shell, that's now supported, even
   though the SSH certificate authentication uses username-USERNAME.

 - The astute reader will notice that not all the API calls in
   gitlab-ce's lib/api/internal.rb support a "username" argument, some
   only support "user_id".

   There's a few reasons for this:

     a) For this to be efficient, I am bending over backwards to avoid
        extra API calls when using SSH certificates.

        Therefore the /allowed API call will now return a "user id" to
        us if we're allowed to proceed further. This is then fed to
        existing APIs that would only be called after a successful
        call to /allowed.

     b) Not all of the git-shell codepaths go through
        /internal/allowed, or ever deal with a repository, e.g. the
        argument-less "Welcome to GitLab", and
        /internal/2fa_recovery_codes. These need to use
        /internal/discover to figure out details about the user, so
        support looking that up by username.

     c) Once we have the "user id", the GL_ID gets passed down to
        e.g. user-authored hooks. I don't want to have those all break
        by having to handle a third GL_ID mode of "username" in
        addition to the current "key id" and "user id".

Add script to update vendored go libs

See merge request gitlab-org/gitlab-shell!212

Refactor for re-usability for future MR's

See merge request gitlab-org/gitlab-shell!210