Goldiloader (https://github.com/salsify/goldiloader) can eager load
associations automatically. This removes the need for adding "includes"
calls in a variety of different places. This also comes with the added
benefit of not having to eager load data if it's not used.

1. Synchronize used version of `parser` gem for both versions of rails: 4 and 5.
2. Fix broken CI pipelines for rails5 branches.

The 2.5.0.4 version is removed from rubygems, so it's skipped.
https://github.com/whitequark/parser/issues/478

git 2.16 will fail badly if there are stale worktrees.

Closes #44115

Didn't compile against newer icu4c versions and was fixed upstream in
https://github.com/brianmario/charlock_holmes/pull/129, which was
releaed in the versions its now locked to.

Release notes: https://github.com/libgit2/libgit2/releases/tag/v0.27.0

This version solves a significant performance issue with generating
large diffs: https://github.com/libgit2/libgit2/issues/4460

When a repository does not exist on a remote, Gitaly won't be able to
clone it. This is correct behaviour, but from the clients perspective a
change in behaviour.

This change implements the client side changes that allows Gitaly to
execute a `git ls-remote <remote-url> HEAD`. This way the client has no
need to shell out to Git.

In the situation where multiple Gitalies are available, one is chosen at
random.

This commit closes https://gitlab.com/gitlab-org/gitlab-ce/issues/43929,
while its also a part of https://gitlab.com/gitlab-org/gitaly/issues/1084

See:

* https://github.com/rails/rails-html-sanitizer/releases
* https://github.com/flavorjones/loofah/releases

James Lopez authored 6 years ago and Mark Fletcher committed 6 years ago

[10.6] Fix GitLab Auth0 integration signs in the wrong user

See merge request gitlab/gitlabhq!2354

But first, rewrite the performance bar in Vue:

1. Remove the peek-host gem and replace it with existing code. This also allows
   us to include the host in the JSON response, rather than in the page HTML.
2. Leave the line profiler parts as here-be-dragons: nicer would be a separate
   endpoint for these, so we could use them on Ajax requests too.
3. The performance bar is too fiddly to rewrite right now, so apply the same
   logic to that.

Then, add features! All requests made through Axios are able to be tracked. To
keep a lid on memory usage, only the first two requests for a given URL are
tracked, though. Each request that's tracked has the same data as the initial
page load, with the exception of the performance bar and the line profiler, as
explained above.

This reverts merge request !17737