`UrlBlocker` protects GitLab and its users from attacks such as
Server Side Request Forgery and DNS Rebind attacks.

Until now, setting `allow_local_network` had no effect on blocking
`255.255.255.255`, whether true or false. Now, when
`allow_local_network` is set to `false` `255.255.255.255` is
blocked through the introduction of a check named
`validate_limited_broadcast_address`.

`255.255.255.255` is the "limited broadcast address", which is used to
make requests to all hosts on a local physical network [1]. Properly
configured routers won't route it. Historically it was used to wake up
offline PCs on a LAN which, since they were asleep, didn't have IP
addresses [2].

While `UrlBlocker` defaults `allow_local_network` to `true`, in
practice it is almost always `false` because of a convention to
use the GitLab configuration option which defaults to `false`.
If a GitLab administrator still wants to  reach `255.255.255.255`,
it can be added explicitly in the Allow List [3].

There is no reason a GitLab user would want to reach this, but it
could potentially be misused if an attacker finds a component
vulnerable to DNS rebinding, for example.

This commit aims to fulfil https://gitlab.com/gitlab-org/gitlab/-/issues/337796

[1]: https://datatracker.ietf.org/doc/html/rfc919#section-7
[2]: https://superuser.com/a/1006951
[3]: https://docs.gitlab.com/ee/security/webhooks.html#allowlist-for-local-requests

Changelog: changed

Update Change Group's Path instructions to match with UI

See merge request gitlab-org/gitlab!82403

Drop old index for security ci builds on name and id parser

See merge request gitlab-org/gitlab!82354

Add git audit streaming events

See merge request gitlab-org/gitlab!76719

When user download source code on GUI.

Fix source position mapping in markdown with frontmatter

See merge request gitlab-org/gitlab!81470

Merge branch '344108-replace-browser-confirm-modal-with-glmodal-in-app-assets-javascripts-environments-components-2' into 'master'

Replace window.confirm with GlModal in environment actions

See merge request gitlab-org/gitlab!80425

Fix variable in _prometheus.html.haml so it shows as a code block

See merge request gitlab-org/gitlab!82395

docs: Gitaly profiling instructions

See merge request gitlab-org/gitlab!82343

Add notes to public docs on how to profile Gitaly. Currently this is
only in our SRE runbooks.

De-duplicate already marked for deletion check

See merge request gitlab-org/gitlab!82173

List comparison to group access tokens in personal tokens

See merge request gitlab-org/gitlab!82227

Param requires_python is optional for pypi

See merge request gitlab-org/gitlab!81946

Make the requires_python optional for the pypi
upload endpoint to conform with pypi standards.

Changelog: fixed

Project settings: fix semi-linear merge description

See merge request gitlab-org/gitlab!82261

Remove Legacy Feature Flag instructions

See merge request gitlab-org/gitlab!82294

Fix the Agent default namespace in docs

See merge request gitlab-org/gitlab!82413

E2E: Log successful adding of license key

See merge request gitlab-org/gitlab!82302

Set KUBE_INGRESS_BASE_DOMAIN for Auto DevOps QA test

See merge request gitlab-org/gitlab!82214

This allows the source-position data to be accurate

Changelog: fixed

Consider non-default config files for Security UI

See merge request gitlab-org/gitlab!81027

Updates create service to use the ci_config_file instead of the default

Changelog: changed
MR:

Remove mirror_scheduling_tracker and ProjectImporScheduleWorker's needs_own_queue tag

See merge request gitlab-org/gitlab!81960

Fix group bot token name in REST API and GraphQL

See merge request gitlab-org/gitlab!81843

Promote test to reliable

See merge request gitlab-org/gitlab!82311

Fix pasting HTML tables in the Content Editor

See merge request gitlab-org/gitlab!82040

- https://gitlab.com/gitlab-org/gitlab/-/merge_requests/82040

Changelog: fixed

CTRT edits for Azure page - part 2

See merge request gitlab-org/gitlab!82388

Include merge-requests in RESERVED_REFS_NAMES

See merge request gitlab-org/gitlab!82326

Upgrades ipynbdiff to 0.4.4

See merge request gitlab-org/gitlab!82323

Clarify comment related to CAPTCHA modal

See merge request gitlab-org/gitlab!82363

Move from UsersHelper to HasUserType

Remove uneeded changes

Add specs to user_spec and user_type_spec