Update validates_hostname to 1.0.6 to fix a bug in parsing hexadecimal-looking domain names

validates_hostname <= 1.0.5 has a bug that breaks hostnames that could be interpreted as hexadecimal numbers. This is fixed in https://github.com/KimNorgaard/validates_hostname/pull/7

Update our version of the gem to one that includes this fix, and add a test for it.

/cc @cpallares @0x7cc

Can we get this into 8.15 do you think?

Closes #827

See merge request !982

Resolve ""Send Email to Users" Feature does not respect blocked users"

See merge request !945

[ci skip]

[ci skip]

[ci skip]

[ci skip]

Geo: Improve project view UI to teach users how to clone from a secondary Geo node and push to a primary.

This Merge request adds a new button into the "repository clone widget" to guide Geo (#76) users how to define a different remote URL for pushing code.
We can infer the primary's node URL when using `HTTP` method, but not for `SSH` or `Kerberos` (as they can vary according to configuration defined into config files).

For the `HTTP` method the instruction will be "complete", while for the others there will be a placeholder instead of the primary's node URL for that repository.  (See screenshots below)

Checklist
- [x] Display a button after the clipboard icon only in secondary Geo nodes
- [x] Clicking in the Geo info button, shows up a dialog with instructions
- [x] Instructions use the selected clone mode to display correct text (HTTP/SSH/KERBEROS)

Closes #789

----

![http_clone](/uploads/4e0298faab6ea602aba158e61d7a3d2c/http_clone.png)

![ssh_clone](/uploads/2e9d421de842db0a938c181326522fd2/ssh_clone.png)

See merge request !905

CE upstream

Unmerged paths: (use "git add/rm ..." as appropriate to mark resolution)

```
both modified:   Gemfile.lock
both modified:   app/assets/javascripts/diff_notes/diff_notes_bundle.js.es6
both modified:   app/assets/javascripts/merge_request_widget.js.es6
both modified:   app/assets/javascripts/protected_branches/protected_branch_dropdown.js.es6
both modified:   app/assets/javascripts/protected_branches/protected_branch_edit.js.es6
both modified:   app/assets/stylesheets/framework/variables.scss
both added:      app/controllers/concerns/oauth_applications.rb
both modified:   app/controllers/concerns/service_params.rb
both modified:   app/helpers/projects_helper.rb
both modified:   app/helpers/sorting_helper.rb
both modified:   app/models/project.rb
both modified:   app/policies/group_member_policy.rb
both modified:   app/policies/group_policy.rb
both modified:   app/views/projects/merge_requests/widget/_open.html.haml
both modified:   app/views/projects/merge_requests/widget/open/_accept.html.haml
both added:      changelogs/unreleased/25482-fix-api-sudo.yml
both modified:   config/application.rb
both modified:   config/gitlab.yml.example
both modified:   db/schema.rb
both modified:   doc/README.md
deleted by them: features/admin/settings.feature
both modified:   features/steps/shared/paths.rb
both modified:   lib/api/helpers.rb
both modified:   public/500.html
both modified:   public/502.html
both modified:   spec/features/admin/admin_settings_spec.rb
both modified:   spec/javascripts/awards_handler_spec.js
both modified:   spec/lib/gitlab/auth_spec.rb
both modified:   spec/models/project_services/chat_message/pipeline_message_spec.rb
both modified:   spec/requests/api/helpers_spec.rb
```

See merge request !974

Since 9f97fa4d, we don't always set label_ids, meaning that we don't
call `issuable.update` is `params` are empty. The issue is that if you
only send a `/spent 5m` command, it builds an associated `timelogs`
record on the issuable that is only save when we update the issuable.

For now, we check that if we have a `spent_time`, we need to update the
issuable in order to save the associated record. This should be
improved.
Signed-off-by: Rémy Coutable <remy@rymai.me>

This reverts commit 25b842d1.

EE: Accept environment variables from the `pre-receive` script

- EE version of gitlab-org/gitlab-ce!7967

See merge request !964

Fix broken specs related to Jenkins service.

See merge request !976

Check if selected object is valid before passing to calback

See: https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/974#note_20210158

See merge request !977

Always use `fixture_file_upload` helper to upload files in tests.

See merge request !975

* Also is not a good idea to use File.open without closing the file
  handler. We should use it with a block or close it explicitly.

Port of "Add Mattermost Service" to EE

See merge request !972

Update the "remove an estimation" command.

The current documentation is not up to date with the current Gitlab version. 

The current command is `/remove_estimate` to remove estimation time of an issue.

See merge request !970

Enable Style/MultilineOperationIndentation in Rubocop

Fixes #25741

See merge request !8125

Mattermost session

This branch is based of tag v8.14.4 so I could test on an instance better.

But stuck on the tests, as setting up the whole doorkeeper stuff doesn't seem to be supported for testing.

See merge request !8033