- Move the `TwoFactorAuthsController`'s `new` action to `show`, since
  the page is not used to create a single "two factor auth" anymore. We
  can have a single 2FA authenticator app, along with any number of U2F
  devices, in any combination, so the page will be accessed after the
  first "two factor auth" is created.
- Add the `u2f` javascript library, which provides an API to the
  browser's U2F implementation.
- Add tests for the JS components

- Turbolinks caches the `head`, so `gon` updates don't show up unless
  the user navigates to page directly (by URL) or performs a refresh.
- The solution is to render `gon` in the body instead.
- Also update the syntax to the new Rails 4 (according to the gon
  README) syntax.

- Need the `mobile?` detection (that the new version provides) for the
  U2F registration/ authentication flow

- To hold registrations from U2F devices, and to authenticate them.
- Previously, `User#two_factor_enabled` was aliased to the
  `otp_required_for_login` column on `users`.
- This commit changes things a bit:
    - `User#two_factor_enabled` is not a method anymore
    - `User#two_factor_enabled?` checks both the
      `otp_required_for_login` column, as well as `U2fRegistration`s
    - Change all instances of `User#two_factor_enabled` to
      `User#two_factor_enabled?`
- Add the `u2f` gem, and implement registration/authentication at the
  model level.

Fix rubocop offense in awardable specs

Fixes failing tests on master.

See merge request !4481

Enable Lint/AmbiguousOperator rubocop cop

Enforce using parentheses if ambiguous operators are detected, like `header *some_method` or `array.select &:even?`.

See #17478

See merge request !4454

[ci skip]

Document the API endpoint for gathering a build log

## What does this MR do?

Adds documentation for gathering a trace build log via the API. Documenting the following:
https://gitlab.com/gitlab-org/gitlab-ce/blob/de20bd5b31715f096db3fb0155c82b0eea992b6c/lib/api/builds.rb#L98-110

## Are there points in the code the reviewer needs to double check?

Please verify that a curl request using the same format as documented works

## Why was this MR needed?

No documentation currently exists

## What are the relevant issue numbers?

#18015 

## Screenshots (if relevant)

See merge request !4467

Fix link to current design reference in the CONTRIBUTING guide

## What does this MR do?

It fixes an outdated link by replacing it with the up-to-date one.

See merge request !4439

Allow bulk-assign labels to issues

- [x] Allow bulk-assignment labels.
- [x] Show indeterminate state for labels present on selection.
- [x] Remove existing labels from selected items if label gets unmarked.
- [x] Fix conflicting tests.
- [x] Write tests.

Closes #13499 and #15489

See merge request !3917

Instead of passing `remove_label_ids`, just pass an empty array for
`label_ids` (and don't pass `add_label_ids` or `remove_label_ids`).

Triggering keyup will re-render the dropdown which is not needed when option persistWhenHide is true

This was re-rendering the dropdown unnecessarily

We need to update the results right away when we do bulk assignment.

1. Don't use instance variables, use `let` instead.
2. Add descriptions for all specs.
3. Share variables where possible.
4. Give labels more vivid names than 1, 2, and 3.
5. Remove deprecation warnings by passing issue IDs as '1,2,3' instead
   of an array, as that's how they're passed by the front-end. (The
   deprecation warning is for passing a nested array, which is what
   happens if an actual array is passed, as:
     `[1, 2, 3].split(',') == [[1, 2, 3]]`