Merge branch 'security-fix-uri-xss-applications-11-4' into 'security-11-4'
[11.4] Reflected XSS in OAuth Authorize window due to redirect_uri allowing arbitrary protocols See merge request gitlab/gitlabhq!2580
[11.4] Reflected XSS in OAuth Authorize window due to redirect_uri allowing arbitrary protocols See merge request gitlab/gitlabhq!2580