Fix Projects::UpdateMirrorService to allow tags pointing to blob objects

After the release of https://gitlab.com/gitlab-org/gitlab_git/merge_requests/103 we changed the way we return the target of tag objects, now it's a Commit object if there is some and nil in any other case, like when a tag points to a Blob object.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/21040

See merge request !673

[ci skip]

Set `in_progress_merge_commit_sha` for fast-forward merges.

- Closes #900

1. This flag is used in conjunction with the "Developers can Merge"
   branch permission, to allow a user to merge MRs without push access
   to a branch.

2. Without this flag set, the user doesn't have access to the protected
   branch, and the merge fails.

3. This flag was previously set for the `Repository#merge` method, but
   not the `Repository#ff_merge` method.

See merge request !671

CE upstream



See merge request !668

[ES] Add explanation comments



See merge request !650

Fix same tiny grammar mistake as in ee

This is a tiny grammar fix that was already merged into EE

https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/667#note_14043471

See merge request !5865

1. This flag is used in conjunction with the "Developers can Merge"
   branch permission, to allow a user to merge MRs without push access
   to a branch.

2. Without this flag set, the user doesn't have access to the protected
   branch, and the merge fails.

3. This flag was previously set for the `Repository#merge` method, but
   not the `Repository#ff_merge` method.

Diff line comments resolve

## What does this MR do?

Diff line comments can be resolved.

Part of #10325 

To do:

- [x] Backend (@DouweM)
  - [x] Fix https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5022#note_13319326. Will be made easier by https://gitlab.com/gitlab-org/gitlab-ce/issues/17237#note_13370331
  - [x] System note when all discussions are resolved
  - [x] Notification when all discussions are resolved
  - [x] Write unit tests
  - [x] Look at resolve time https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5022#note_13912743 - Fixed by 4a13aa9f
- [x] Frontend (@iamphill)
  - [x] Fix bugs
  - [x] Write more feature tests 
- [x] Frontend (@connorshea)
  - [x] Address frontend feedback
  - [x] Feature specs for Jump feature
  - [x] Documentation
  - [x] Add Vue.js in a standard way

See merge request !5022

Update doorkeeper to 4.2.0

Changelog: https://git.io/v6PnV

See merge request !5881

2FA checks for Git over HTTP

## What does this MR do?

This MR allows the use of `PersonalAccessTokens` to access Git over HTTP and makes that the only allowed method if the user has 2FA enabled. If a user with 2FA enabled tries to access Git over HTTP using his username and password the request will be denied and the user will be presented with the following message:

```
remote: HTTP Basic: Access denied
remote: You have 2FA enabled, please use a personal access token for Git over HTTP.
remote: You can generate one at http://localhost:3000/profile/personal_access_tokens
fatal: Authentication failed for 'http://localhost:3000/documentcloud/underscore.git/'
```

## What are the relevant issue numbers?

Fixes #13568 

See merge request !5764

Allow LDAP `sync_ssh_keys` setting to be set to `true`

In that case `sync_ssh_keys` will default to the `sshPublicKey` value

Fixes #8

See merge request !670

Changelog: https://git.io/v6PnV

Handle legacy sort order values

Convert the legacy sort order values id_asc / id_desc into the ones we use now, created_at / created_desc, to stop the dropdown being blank.

Closes #21028.

See merge request !5880

2FA checks for API workflows

## What does this MR do?

It adds a check to the API `/session` endpoint that will deny authentication requests to users that have 2FA enabled. In the error message it will instruct them to use a Personal Access Token instead.

It adds a check to the `/oauth/token` endpoint, when `grant_type: 'password'` is used, so that no OAuth2 access token can be generated if the user has 2FA enabled. This endpoint should not be used by OAuth applications, anyway. OAuth apps should follow the flow of redirecting the user to GitLab, where 2FA access restrictions apply and logging them in there. Once successfully authenticated, the OAuth token is passed to the client.

## Why was this MR needed?

No 2FA check on API endpoints.

## What are the relevant issue numbers?

Fixes #2979

See merge request !5820

Update Hamlit to 2.6.1

Fixes gitlab-org/gitlab-ce#21025 and gitlab-org/gitlab-ce#21017

See merge request !5873

The sort orders used to be id_asc / id_desc, and are now created_asc /
created_desc. Users can still have cookies containing the old sort
orders, or bookmarks to links specifying them, so convert these to the
new versions quietly.

In that case `sync_ssh_keys` will default to the `sshPublicKey` value.

Added checks for 2FA to the API `/sessions` endpoint and the Resource Owner Password Credentials flow.

# Conflicts:
#	db/schema.rb

Support slash commands in issues / MR description & comments

See merge request !5021

Merge branch '3225-ace-editor-causing-404-errors-every-time-you-try-to-edit-a-file-in-the-webui' into 'master'

Fix Ace syntax highlighting with compiled assets

## What does this MR do?

Update ACE to 4.1.0 to allow modes (syntax highlighting files for particular languages) to be lazily loaded.

## Are there points in the code the reviewer needs to double check?

Don't think so.

## Why was this MR needed?

Syntax highlighting in the file editor only worked in development and test modes, not in production!

## What are the relevant issue numbers?

Closes #3225.

## Screenshots (if relevant)

First, the test setup - add these lines to `development.rb`:
```ruby
  config.assets.debug = false
  config.assets.compile = false
  config.assets.digest = true
```

Then, before starting the server, run `bundle exec rake assets:clobber assets:precompile`.

Before:

![image](/uploads/486198e273019f8969d2e90560d82928/image.png)

There is an error in the console because `/assets/ace/mode-ruby.js` was not found (it's only available when assets are compiled on demand).

After:

![image](/uploads/6aa0d69b7efdfd6fe6aa22b9a49e9716/image.png)

This loads `/assets/ace/mode-ruby-3915f95a6cc47306b1305e4dcb7aca25b2ef9c49b18ec6011707135b6575d8f3.js`, which works because the precompile step included it and told ACE where to find it.

## Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- ~~[Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)~~
- ~~API support added~~
- Tests
  - ~~Added for this feature/bug~~
  - [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !5501

Abuse Reports message truncation

## What does this MR do?

Adds dynamic message truncation to abuse reports

## Are there points in the code the reviewer needs to double check?

Is the new UI OK?

## Why was this MR needed?

Admin UX

## What are the relevant issue numbers?

Closes #13664.

## Screenshots (if relevant)

**UPDATED:**

![Screen_Shot_2016-07-07_at_03.02.43](/uploads/2e1a1122e0194f8ffa48054c18523ccd/Screen_Shot_2016-07-07_at_03.02.43.png)

## Does this MR meet the acceptance criteria?

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
Closes #13664

See merge request !5032

Truncated long user lists in award emoji tooltips

## What does this MR do?
Truncates award emoji tooltips so that they only show 10 users maximum.

Further users are indicated by appending "and X more."

## Are there points in the code the reviewer needs to double check?
Is 10 too little, should it be raised?

My test cases rely on join() to build the expected output.
This feels a little iffy is it alright?

## Why was this MR needed?
Some issues have a large number of thumbs causing tooltips to be very large.

## What are the relevant issue numbers?
closes #18334, closes #19542

## Screenshots (if relevant)
##### Before
![Screenshot_from_2016-06-20_19-49-12](/uploads/d7a14dd87bb3da2acd7c0818de99852b/Screenshot_from_2016-06-20_19-49-12.png)

##### After
![Screenshot_from_2016-06-20_19-50-58](/uploads/f7f05c44594bfe8cec7dfd48802753a6/Screenshot_from_2016-06-20_19-50-58.png)

Truncation point modified for purposes of screenshot

## Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [x] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [x] API support added
- [x] Tests
  - [x] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !4780

Deployment and Play endpoints

See merge request !5825