- "two-factor" for OTP-based 2FA
- "two-factor-via-u2f-device" for U2F-based 2FA
- "standard" for non-2FA login

- Move the `authenticate_with_two_factor` method from
  `ApplicationController` to the `AuthenticatesWithTwoFactor` module,
  where it should be.

- Move the `TwoFactorAuthsController`'s `new` action to `show`, since
  the page is not used to create a single "two factor auth" anymore. We
  can have a single 2FA authenticator app, along with any number of U2F
  devices, in any combination, so the page will be accessed after the
  first "two factor auth" is created.
- Add the `u2f` javascript library, which provides an API to the
  browser's U2F implementation.
- Add tests for the JS components

- Turbolinks caches the `head`, so `gon` updates don't show up unless
  the user navigates to page directly (by URL) or performs a refresh.
- The solution is to render `gon` in the body instead.
- Also update the syntax to the new Rails 4 (according to the gon
  README) syntax.

- Need the `mobile?` detection (that the new version provides) for the
  U2F registration/ authentication flow

- To hold registrations from U2F devices, and to authenticate them.
- Previously, `User#two_factor_enabled` was aliased to the
  `otp_required_for_login` column on `users`.
- This commit changes things a bit:
    - `User#two_factor_enabled` is not a method anymore
    - `User#two_factor_enabled?` checks both the
      `otp_required_for_login` column, as well as `U2fRegistration`s
    - Change all instances of `User#two_factor_enabled` to
      `User#two_factor_enabled?`
- Add the `u2f` gem, and implement registration/authentication at the
  model level.

Fix rubocop offense in awardable specs

Fixes failing tests on master.

See merge request !4481

Enable Lint/AmbiguousOperator rubocop cop

Enforce using parentheses if ambiguous operators are detected, like `header *some_method` or `array.select &:even?`.

See #17478

See merge request !4454

[ci skip]

Document the API endpoint for gathering a build log

## What does this MR do?

Adds documentation for gathering a trace build log via the API. Documenting the following:
https://gitlab.com/gitlab-org/gitlab-ce/blob/de20bd5b31715f096db3fb0155c82b0eea992b6c/lib/api/builds.rb#L98-110

## Are there points in the code the reviewer needs to double check?

Please verify that a curl request using the same format as documented works

## Why was this MR needed?

No documentation currently exists

## What are the relevant issue numbers?

#18015 

## Screenshots (if relevant)

See merge request !4467

Fix link to current design reference in the CONTRIBUTING guide

## What does this MR do?

It fixes an outdated link by replacing it with the up-to-date one.

See merge request !4439

Allow bulk-assign labels to issues

- [x] Allow bulk-assignment labels.
- [x] Show indeterminate state for labels present on selection.
- [x] Remove existing labels from selected items if label gets unmarked.
- [x] Fix conflicting tests.
- [x] Write tests.

Closes #13499 and #15489

See merge request !3917

Instead of passing `remove_label_ids`, just pass an empty array for
`label_ids` (and don't pass `add_label_ids` or `remove_label_ids`).

Triggering keyup will re-render the dropdown which is not needed when option persistWhenHide is true

This was re-rendering the dropdown unnecessarily

We need to update the results right away when we do bulk assignment.