RubyZip allows us to perform strong validation of
expanded paths where we do extract file.

We introduce the following additional checks
to extract routines:

1. None of path components can be symlinked,
2. We drop privileges support for directories,
3. Symlink source needs to point within the target directory,
   like `public/`,
4. The symlink source needs to exist ahead of time.

RubyZip allows us to perform strong validation of
expanded paths where we do extract file.

We introduce the following additional checks
to extract routines:

1. None of path components can be symlinked,
2. We drop privileges support for directories,
3. Symlink source needs to point within the target directory,
   like `public/`,
4. The symlink source needs to exist ahead of time.

Partially addresses #47424.

In UpdatePagesService, we were seeing a large number of open pack files in
production. Calling Project#cleanup removes a reference to Rugged::Repository
and forces libgit2 to close file descriptors and free its internal memory
cache.

Relates to https://gitlab.com/gitlab-com/infrastructure/issues/3965#note_65837525

Object store for artifacts

Closes gitlab-ce#29203

See merge request !1762

Currently we still need to run EnsureStageService within a transaction,
because when it runs within in a transaction we are going to stick to
the primary database when using database load balancing. Extracting this
out of the transaction makes it possible to hit into problems with
replication lag in pipeline commit status API, which can cause a lot of
trouble.

The initializers including this were doing so at the top level, so every object
loaded after them had a `current_application_settings` method. However, if
someone had rack-attack enabled (which was loaded before these initializers), it
would try to load the API, and fail, because `Gitlab::CurrentSettings` didn't
have that method.

To fix this:

1. Don't include `Gitlab::CurrentSettings` at the top level. We do not need
   `Object.new.current_application_settings` to work.
2. Make `Gitlab::CurrentSettings` explicitly `extend self`, as we already use it
   like that in several places.
3. Change the initializers to use that new form.

As its hard right now to determine what is a good metric and whats not,
these two are not listed in the docs, nor will they get a CHANGELOG
entry.

As per review feedback
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/13072#note_35853177

Closes https://gitlab.com/gitlab-org/gitlab-ee/issues/225

There is now a `Projects::Settings` module, for the members
controller. Ensure that we get the actual settings, not that module.