Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.

Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.

- Need to pass in a `page_slug` to the filter, so it can rewrite based
  on the current page (all links are rewritten to the level of the app root).
- The earlier `markdown_preview` endpoint was at the level of the wiki.
  We need to know the current page (for rewriting, as above), so this
  commit moves the endpoint to the level of a wiki page.
- Fix all tests

This splits the Markdown rendering and reference extraction phases into
two distinct code bases. The reference extraction phase no longer relies
on the html-pipeline Gem (and any related code) and allows for
extracting of references from multiple HTML nodes in a single pass. This
means that if you want to extract user references from 200 comments you
no longer need to run 200 times N number of queries, instead only a
handful of queries may be needed.

Closes #15527.

Signed-off-by: Rémy Coutable <remy@rymai.me>

update changelog