Restrict Todo API mark_as_done endpoint to the user's todos only

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

Currently we still need to run EnsureStageService within a transaction,
because when it runs within in a transaction we are going to stick to
the primary database when using database load balancing. Extracting this
out of the transaction makes it possible to hit into problems with
replication lag in pipeline commit status API, which can cause a lot of
trouble.

This ensures that we have more visibility in the number of SQL queries
that are executed in web requests. The current threshold is hardcoded to
100 as we will rarely (maybe once or twice) change it.

In production and development we use Sentry if enabled, in the test
environment we raise an error. This feature is also only enabled in
production/staging when running on GitLab.com as it's not very useful to
other users.

We can simplify the code quite a bit and improve performance by using
grape-entity merge fields:

https://github.com/ruby-grape/grape-entity/tree/v0.6.0#merge-fields

Relates to #42030