Closes gitaly#915

If we search for notes before the MR was merged, we have to load every commit
that was ever part of the MR, or mentioned in a push. In extreme cases, this can
be tens of thousands of commits to load, but we know they can't revert the merge
commit, because they are from before the MR was merged.

In the (rare) case that we don't have a `merged_at` value for the MR, we can
still search all notes.

Uses `list_commits_by_oid` on the CommitService, to request the needed
commits for pipelines. These commits are needed to display the user that
created the commit and the commit title.

This includes fixes for tests failing that depended on the commit
being `nil`. However, now these are batch loaded, this doesn't happen
anymore and the commits are an instance of BatchLoader.

Allows ordering in GET api/v4/projects/:project_id/repository/contributors
through `order_by` and `sort` params.
The available `order_by` options are: name|email|commits.
The available `sort` options are: asc|desc.

After installing a new gem, batch-loader, a construct can be used to
queue data to be fetched in bulk. The gem was also introduced in both
gitlab-org/gitlab-ce!14680 and gitlab-org/gitlab-ce!14846, but those mrs
are not merged yet.

For the generation of diffs, both the old blob and the new blob need to
be loaded. This for every file in the diff, too. Now we collect all
these so we do 1 fetch. Three `.allow_n_plus_1_calls` have been removed,
which I expect to be valid, but this needs to be confirmed by a full CI
run.

Possibly closes:
- https://gitlab.com/gitlab-org/gitlab-ce/issues/37445
- https://gitlab.com/gitlab-org/gitlab-ce/issues/37599
- https://gitlab.com/gitlab-org/gitlab-ce/issues/37431

This adds an optimised way of getting the latest pipeline status for a
list of Commit objects (or just a single one).

we need the commit object for the updated verification that also checks
the committer's email to match the gpg key and user's emails.

Also improved the UT for better documenting this change.

The list of commits must be generated from the merge request,
not from a diff of the branches.

Follow the `cherry pick -x` format for the first line, and the
interactive rebase format for the commits in the merge, in case
of merge commit

This also fixes the inconsistency between non/merge commits in the number of newlines introduced.

An upcoming update to rubocop-gitlab-security added additional
violations.

Store the original commit in the commit message. In case of
merge commit, the commits added to the start branch are also
listed.

This helps keep the abstraction layers simpler, and also keep the
interface of those methods consistent, in case of implementation
changes.

as we write the cache in the gpg commit class already the read should
also happen there.

This also removes all logic from the main commit class, which just
proxies the call to the Gpg::Commit now.

we store the result of the gpg commit verification in the db because the
gpg verification is an expensive operation.