Fix private feature Elasticsearch leak

See merge request gitlab/gitlabhq!3450

Add spec to test different combinations.
Accept string for required_minimum_access_level
Allow more flexible project membership query

Fix broken specs : Generate new GPG key in place of expired one

Closes #32956

See merge request gitlab-org/gitlab!17853

[ci skip]

Fix Gitaly SearchBlobs flag RPC injection [Gitaly v1.65.1]

See merge request gitlab/gitlabhq!3433

Prevent Bypassing Email Verification using Salesforce

See merge request gitlab/gitlabhq!3395

Check that SAML identity linking validates the origin of the request

See merge request gitlab/gitlabhq!3396

Only render fixed number of mermaid blocks

See merge request gitlab/gitlabhq!3411

Merge branch 'security-12717-fix-confidential-issue-assignee-visible-to-guests-12-3' into '12-3-stable'

Display only participants that user has permission to see

See merge request gitlab/gitlabhq!3421

Redirect user to root path after unsubscribing from private resource

See merge request gitlab/gitlabhq!3423

Hide disabled project milestones in project settings on group level

See merge request gitlab/gitlabhq!3424

Add policy check if cross reference system notes are accessible

See merge request gitlab/gitlabhq!3426

Cancel all running CI jobs when user is blocked

See merge request gitlab/gitlabhq!3436

Filter not accessible label events

See merge request gitlab/gitlabhq!3440

Label events may use cross-project or cross-group references,
if the projects are not accessible by user, we don't show these
label events.

[ci skip]

This prevents a MITM attack where attacker could
still access Git repository if any jobs were
running long enough.

If user unsubsrcribes from a resource that they no longer have
access to they should not be revealed the resource path, but be
redirected to app root instead.

https://gitlab.com/gitlab-org/gitlab-ce/issues/64938

Fix rubocop offences and add changelog

Add email_verified key for feature specs

Add code review remarks

Add code review remarks

Fix specs

[ci skip]

If the request wasn't initiated by gitlab we shouldn't add the new
identity to the user, and instead show that we weren't able to link
the identity to the user.

This should fix: https://gitlab.com/gitlab-org/gitlab-ce/issues/56509

[ci skip]