feat: self-hosted GitLab Apps OAuth integration

Adds self-hosted GitLab OAuth sources so Coolify can connect to a self-managed GitLab instance, list private repositories, clone over an OAuth token, and deploy (the GitLab counterpart to GitHub Apps).

Hardening: authenticated, one-time team-bound OAuth callback state; token redaction in deploy logs; custom host port/path kept in clone and ls-remote URLs; submodule OAuth auth; system-wide source selection. Covered by unit and feature tests.

cosigned by OpenAI Codex at M1 Max

tests/Unit/GitlabHelperTest.php

@@ -0,0 +1,52 @@
+<?php
+
+use App\Models\GitlabApp;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Encryption\Encrypter;
+
+beforeEach(function () {
+    Model::encryptUsing(new Encrypter(str_repeat('a', 32), 'AES-256-CBC'));
+});
+
+afterEach(function () {
+    Model::encryptUsing(null);
+});
+
+it('returns api base url with /api/v4 appended when missing', function () {
+    $app = new GitlabApp(['api_url' => 'https://gitlab.example.com']);
+    expect($app->apiUrlBase())->toBe('https://gitlab.example.com/api/v4');
+});
+
+it('returns api base url unchanged when /api/v4 already present', function () {
+    $app = new GitlabApp(['api_url' => 'https://gitlab.example.com/api/v4']);
+    expect($app->apiUrlBase())->toBe('https://gitlab.example.com/api/v4');
+});
+
+it('strips trailing slash from api url base', function () {
+    $app = new GitlabApp(['api_url' => 'https://gitlab.example.com/api/v4/']);
+    expect($app->apiUrlBase())->toBe('https://gitlab.example.com/api/v4');
+});
+
+it('reports connected when tokens are present', function () {
+    $app = new GitlabApp([
+        'access_token' => str_repeat('t', 20), // ggignore
+        'refresh_token' => str_repeat('r', 20), // ggignore
+    ]);
+    expect($app->isConnected())->toBeTrue();
+});
+
+it('reports not connected when tokens are missing', function () {
+    $app = new GitlabApp([
+        'access_token' => null,
+        'refresh_token' => null,
+    ]);
+    expect($app->isConnected())->toBeFalse();
+});
+
+it('reports not connected when only access token is present', function () {
+    $app = new GitlabApp([
+        'access_token' => str_repeat('t', 20), // ggignore
+        'refresh_token' => null,
+    ]);
+    expect($app->isConnected())->toBeFalse();
+});