Disabled features are ignored as they are grey areas

Some feature allows GUEST to access only if project is not private.
This method returns access level when targeting private projects.

Guest are blocked to certain feature when project is private,
therefore the scope would filter additionally with REPORTER level.

Remove impossible cases due to private project's features can only be
private or disabled.

Fix spec due to sidekiq indexing not triggered.

Update guest use cases: some features has additional constraint that
"Guest users are able to perform action on public/internal projects,
but not private ones."

[ci skip]

[ci skip]

[ci skip]

[ci skip]

Mask Sentry auth token

See merge request gitlab/gitlabhq!3504

Private/internal repository enumeration via bruteforce on a vulnerable URL

See merge request gitlab/gitlabhq!3491

Return 404 on LFS request if project doesn't exist

See merge request gitlab/gitlabhq!3506

Only assign merge params when allowed

See merge request gitlab/gitlabhq!3487

Pass all wiki markup formats through our Banzai pipeline filters

See merge request gitlab/gitlabhq!3485

Require Maintainer permission on group where project is transferred to

See merge request gitlab/gitlabhq!3486

Use the '\A' and '\z' regex anchors in `InternalRedirect` to mitigate an Open Redirect issue.

See merge request gitlab/gitlabhq!3488

Merge branch 'security-2914-labels-visible-despite-no-access-to-issues-repositories-12-4' into '12-4-stable'

Labels visible despite no access to issues & repositories

See merge request gitlab/gitlabhq!3489

Project path reveals labels from Private project if the issue is moved to public project

See merge request gitlab/gitlabhq!3490

Nested GraphQL query with circular relationship can cause Denial of Service

See merge request gitlab/gitlabhq!3492

Filter out search results based on permissions to avoid bugs leaking data

See merge request gitlab/gitlabhq!3496

Merge branch 'security-65756-ex-admin-attacker-can-comment-in-internalsecurity-65756-ex-admin-attacker-can-comment-in-internal-12-4' into '12-4-stable'

Improper access control allows the attacker to comment in internal commit after they are no longer admin

See merge request gitlab/gitlabhq!3497

Merge branch 'security-ag-hide-private-members-in-project-member-autocomplete-12-4' into '12-4-stable'

Hide private members in project member autocomplete

See merge request gitlab/gitlabhq!3503

This makes it so we mask Sentry's auth token. This mask only occurs in
the UI.

- Include new types in SystemNoteMetadata
- Add Label and Milestone reference_pattern to
Mentionable::ReferenceRegexes to be checked for cross references