Restrict Todo API mark_as_done endpoint to the user's todos only

Merge branch 'security-10-4-25223-snippets-finder-doesnt-obey-feature-visibility' into 'security-10-4'

[Port for security-10-4]: Makes SnippetFinder ensure feature visibility

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

We can simplify the code quite a bit and improve performance by using
grape-entity merge fields:

https://github.com/ruby-grape/grape-entity/tree/v0.6.0#merge-fields

Relates to #42030

Jan Christophersen authored 7 years ago and James Lopez committed 7 years ago

Resolve "Projects API: filter 'with_issues_enabled=true' returns projects with 'issues_enabled=false'"

Signed-off-by: Rémy Coutable <remy@rymai.me>

Adds sorting to deployments API through the `order_by` and sort
`fields`.

[10.3] Migrate `can_push` column from `keys` to `deploy_keys_project`

See merge request gitlab/gitlabhq!2276

(cherry picked from commit f6ca52d31bac350a23938e0aebf717c767b4710c)

1f2bd3c0 Backport to 10.3

check project access on MR create

See merge request gitlab/gitlabhq!2273

(cherry picked from commit 1fe2325d6ef2bced4c5e97b57691c894f38b2834)

43e85f49 check project access on MR create

Merge branch 'security-10-3-do-not-expose-passwords-or-tokens-in-service-integrations-api' into 'security-10-3'

Filter out sensitive fields from the project services API

See merge request gitlab/gitlabhq!2281

(cherry picked from commit 476f2576444632f2a9a61b4cead9c1077f2c81d7)

2bcbbda0 Filter out sensitive fields from the project services API

Enables project milestone deletion via DELETE /projects/:id/milestones/:milestone_id