Set a restrictive CORS policy for the API

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/22450

See merge request !1998

Cross-origin requests can still be made, as long as the client doesn't
use the Rails session cookie to do so. Existing clients should not
be setting 'withCredentials: true', so this should be fine.

Keep API mounts in alphabetical order

## What does this MR do?

Just a cosmetic change to keep the API mounts in order.

See merge request !6515

Fixes issue with rails reserved keyword type exporting/importing services.

The attribute `type`in services was being ignored by Import/Export. Added `type` as a method call in the export, as `type` gets ignored invoking `to_json`, manually adding this as a method in `import_export.yml` solves the problem. 

On a different note, I found assigning a title directly to `CustomIssueTrackerService` didn't play very well with `prop_accessor`:

```ruby
> CustomIssueTrackerService.new(title: 'asdf')
NoMethodError: undefined method `[]=' for nil:NilClass
> CustomIssueTrackerService.new(title: nil)
NoMethodError: undefined method `[]=' for nil:NilClass
```

This was also causing the Import/Export to failed... So I added a custom setter that fixed the problem.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/22461

See merge request !6499

Replace deprecated Devise helper with new helper

Closes #22357

See merge request !6462

Fix trivial typo in docs



See merge request !5849

Fixes issue with rails reserved keyword type exporting/importing services. Also fixed CustomIssueTrackerService title setter and added relevant specs.

Remove gitlab_meta gem



See merge request !6510

Fix typo in README

[ci skip]

See merge request !6512

cannonical -> canonical

Use base SHA for patches and diffs

## What does this MR do?

Switch from using 'start SHA' to 'base SHA' for patches and diffs

## Are there points in the code the reviewer needs to double check?

## Why was this MR needed?

Makes the downloaded patches and diffs on the merge request page match the frontend-rendered "changes" in these scenarios:

* Unpatched gitlab-workhorse, downloading patchsets of open MRs (https://gitlab.com/gitlab-org/gitlab-workhorse/merge_requests/68)
* Unpatched gitlab-workhorse, downloading diffs of open and merged MRs
* Patched gitlab-workhorse, downloading patchsets of merged merge requests

## What are the relevant issue numbers?

Closes #22229

See merge request !6435

Fix typo in README.md

## What does this MR do?

Fixes a typo in the documentation of the gitlab-ci-runner environment variables

See merge request !6340

Fix CHANGELOG.

cc: @stanhu

See merge request !6505

Milestone tab badges

### What does this MR do?
Adds count badges to the tabs on the Milestone page to mirror the Issue page.

### Are there points in the code the reviewer needs to double check?
CSS: Padding was added to the `.milestone` element to make expired milestones look good.

### Why was this MR needed?
For consistency with other tabs

### What are the relevant issue numbers?
Closes #20114 

### Screenshots (if relevant)

**Before**
<img src="/uploads/1f75853a863a9058ee409916b7ee4057/Screen_Shot_2016-07-22_at_13.22.20.png" width="362">

**After**
<img src="/uploads/8a058290850f571db249dd9b23f5138d/Screen_Shot_2016-07-22_at_13.21.58.png"  width="303">

![Screen_Shot_2016-08-23_at_1.42.56_AM](/uploads/b072dc6bdf505b2fce46660beaf0eae7/Screen_Shot_2016-08-23_at_1.42.56_AM.png)

![Screen_Shot_2016-08-23_at_1.43.15_AM](/uploads/e7440bf2aa628aa4dba63863083699c0/Screen_Shot_2016-08-23_at_1.43.15_AM.png)

### Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [x] Added for this feature/bug
  - [x] All builds are passing
- [ ] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !5946

Removed z-index from flash container

## What does this MR do?

Fixes a styling bug where the flash container would be above the header when scrolling.

Before it looked like this when scrolling:

![Screen_Shot_2016-09-08_at_14.06.36](/uploads/d639287329643d26454a997e3917bc53/Screen_Shot_2016-09-08_at_14.06.36.png)

Now it looks like this when scrolling:

![Screen_Shot_2016-09-08_at_14.07.37](/uploads/7c1c5e38adc9b9011558d4190d3520fe/Screen_Shot_2016-09-08_at_14.07.37.png)

## Are there points in the code the reviewer needs to double check?

I can't think of any good reason why this would need to be above another element. But you never know!

Closes #20713 

See merge request !6264

Merge branch '22459-tooltips-for-mini-pipeline-graph-in-pipeline-list-use-the-svg-instead-of-container' into 'master'

Fixed pipeline stage svg link tooltip

## What does this MR do?

Adds `display: block` to the `.stage-container` class which allows the dimensional constraints of the link to be calculated correctly so the `mouseover` events are fired correctly.

## Are there points in the code the reviewer needs to double check?

## Why was this MR needed?

Hovering the stage icons to reveal their SVG was buggy and would flash.

## Screenshots (if relevant)

![2016-09-23_14.59.17](/uploads/ad4c85fb08f032cc3f5d17749d3f7091/2016-09-23_14.59.17.gif)

I just realised that Gifox actually adds its own mouse that isn't positioned or sized correctly so this doesn't look right, you'll have to `checkout` to confirm.

/cc @dimitrieh I found a con about Gifox! 😆 

## Does this MR meet the acceptance criteria?

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [ ] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [ ] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [ ] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?


Closes #22459

See merge request !6494

Fix a memory leak in HTML::Pipeline::SanitizationFilter::WHITELIST

See merge request !6456

Add link to broadcast messages docs

[ci skip]

See merge request !6495

Fix database seeds for development environment

## What does this MR do?

This MR fixes database seeds for development environment and adds CI test for it.

## Why was this MR needed?

Database seeds for development environment are often broken, and we are not able to catch that when someone modified `db/fixtures` and forgets to reseed database.

Closes #22422

See merge request !6475

Changed links that wrap the icon svg to `display: block` so there isn't any issues knowing when `mouseover` occurs

The previous fix introduced another leak; as it made
Banzai::Filter::SanitizationFiler#customized? always return false, so we
were always appending two elements to
HTML::Pipeline::SanitizationFilter::WHITELIST[:elements]. This growth in
the elements array would slow the sanitization process over time.

This reverts commit 504a3b5e.

[ci skip]
Signed-off-by: Rémy Coutable <remy@rymai.me>

Speed up group milestones show page

See merge request !6457

[ci skip]
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix Cycle Analytics landing widget state and improve state management in Vue.

## What does this MR do?
- Fixes Cycle Analytics help widget show/hide issue
- Addresses initial MR feedback with improving Vue state management logic
- Fixes cookie path of the help widget so when you close a help widget in a repo it won't be visible for other repos.

## Are there points in the code the reviewer needs to double check?
- Should we move `gl.cycleAnalyticsModel` to a new file.

## Why was this MR needed?
- Addresses feedbacks of [initial MR](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5986) and fixes #22483

## Screenshots (if relevant)

## Does this MR meet the acceptance criteria?

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [x] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [x] API support added
- Tests
  - [x] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?
Fixes #22483

See merge request !6492

Fixes #22508
[ci skip]

Makes Cycle analytics mobile friendly

## What does this MR do?
Makes Cycle analytics page mobile friendly

## Are there points in the code the reviewer needs to double check?

## Why was this MR needed?
Cycle analytics page was not mobile friendly

## Screenshots (if relevant)
![optionB](/uploads/a1d7f2f4db100e1a8aa76c0156ef8641/optionB.png)

## Does this MR meet the acceptance criteria?

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [ ] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?
fixes #22444

See merge request !6482

Make Gitlab::Redis.params safe for mutation

Would have avoided https://gitlab.com/gitlab-com/infrastructure/issues/464

Defends in depth against programming mistakes.

See merge request !6472