Prevent OAuth phishing attack by presenting detailed wording about app to user during authorization

See merge request gitlab-org/gitlab-ce!15311

Use a non-superuser user to access GitLab to ensure permissions are proper

Closes #39932

See merge request gitlab-org/gitlab-ce!15301

Icon Sprite URL needs to be local even if asset_host is set

See merge request gitlab-org/gitlab-ce!15289

Prevent OAuth phishing attack by presenting detailed wording about app to user during authorization

See merge request gitlab/gitlabhq!2205

We have run into permission issues with MySQL triggers in #36633 that
would have been caught earlier either if our migration tests or GitLab QA
tests had been testing against non-superuser users. This change creates
a non-superuser that has access to the GitLab test database and uses that.

Closes #39932

Add 10.1.2 security fixes to CHANGELOG on master

See merge request gitlab-org/gitlab-ce!15305

Add 10.1.2 security fixes to CHANGELOG.md

See merge request gitlab-org/gitlab-ce!15302

[ci skip]

Disable issue action button whilst submitting and test

See merge request gitlab-org/gitlab-ce!15211

add glossary part 1

See merge request gitlab-org/gitlab-ce!15247

Move clear search test to JS to reduce overkill

See merge request gitlab-org/gitlab-ce!15154

Improve breadcrumbs clipping

Closes #37920

See merge request gitlab-org/gitlab-ce!15164

Add /groups/:id/subgroups endpoint to API

Closes #32652

See merge request gitlab-org/gitlab-ce!15142

Always return full avatar URL for private/internal groups/projects when asset host is set

See merge request gitlab-org/gitlab-ce!15288

Part of https://gitlab.com/gitlab-org/gitlab-ce/issues/33661

Fix access to the final page of todos

See merge request gitlab-org/gitlab-ce!15293

Enables scroll to bottom once user has scrolled back to bottom in job log

Closes #34846 and #39109

See merge request gitlab-org/gitlab-ce!15260

Use the new simpler `Pick into X.Y` labels workflow after the 7th

See merge request gitlab-org/gitlab-ce!15282

Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix acceptance of username for Mattermost service update

Closes #39895

See merge request gitlab-org/gitlab-ce!15275

The todos page limit is 20, and both that and a user's pending todo count are
integers. Using integer division means that the result's floor will be taken,
defeating the point of the later call to `#ceil`.

So we need to convert one side of the division to a float first, otherwise the
last page won't be treated as available.

Revert "add metrics tagging to the sidekiq middleware"

Closes #39958

See merge request gitlab-org/gitlab-ce!15285

Make it possible to define global scenario attributes

Closes gitlab-qa#87

See merge request gitlab-org/gitlab-ce!15239

Add GitHub enterprise support to the GitHub Rake task and better handle rate limiting being disabled

See merge request gitlab-org/gitlab-ce!15284

Include X-Content-Type-Options (XCTO) header into API responses

See merge request gitlab/gitlabhq!2211

(cherry picked from commit 6c818e77f2abeef2dd7b17a269611b018701fa79)

e087e075 Include X-Content-Type-Options (XCTO) header into API responses

Replace SSRF resolver with Addrinfo.getaddrinfo to include alternative localhost versions

See merge request gitlab/gitlabhq!2219

(cherry picked from commit 4a1e73783d5480aa514db7b53e10c075f95580b5)

1bffa0c3 Replace SSRF resolver with Addrinfo.getaddrinfo to include alternative localhost versions