Automatically update MR merge-ref along merge status

See merge request gitlab-org/gitlab-ce!29569

Adds enum certificate_source to pages_domains table
with default manually_uploaded

Mark certificates as 'gitlab_provided'
if the were obtained through Let's Encrypt

Mark certificates as 'user_provided' if they were uploaded through
controller or api

Only show private key in domain edit form if it is 'user_provided'

Only show LetsEncrypt option if is enabled by application settings
(and feature flag)

Refactor and fix some specs to match new logic

Don't show Let's Encrypt certificates as well

This couples the code that transitions the `MergeRequest#merge_status`
and refs/merge-requests/:iid/merge ref update.

In general, instead of directly telling `MergeToRefService` to update
the merge ref, we should rely on `MergeabilityCheckService` to keep
both the merge status and merge ref synced. Now, if the merge_status is
`can_be_merged` it means the merge-ref is also updated to the latest.

We've also updated the logic to be more systematic and less user-based.

This commit adds
 - feature specs
  - to test the ability of a user with "developer" permission
    to delete tags in repositories.
 - documentation

The bulk delete api endpoint for container registries can
only be called once per hour. If a user calls the endpoint more
than once per hour, they will now receive a 400 error with a
descriptive message.

We are deprecating this service in favor of instance wide clusters.
Therefore we removed some code that is not anymore needed for a
readonly cluster and also we added some flags to allow for this
deprecation. These flags are to be removed in the next release when
we finally completelly remove KubernetesService.

Expose currently supported events properly on services API

Closes #56737

See merge request gitlab-org/gitlab-ce!29736

Fix plan stage query and the way it is displayed