Make it possible to lock runner on a specific project
Make it possible to lock runner on a specific project.

----

----

Closes#3407
See merge request !4093
- To hold registrations from U2F devices, and to authenticate them.
- Previously, `User#two_factor_enabled` was aliased to the
`otp_required_for_login` column on `users`.
- This commit changes things a bit:
- `User#two_factor_enabled` is not a method anymore
- `User#two_factor_enabled?` checks both the
`otp_required_for_login` column, as well as `U2fRegistration`s
- Change all instances of `User#two_factor_enabled` to
`User#two_factor_enabled?`
- Add the `u2f` gem, and implement registration/authentication at the
model level.
Fix a description for default scope on builds
Should be "**All* builds (from this project)" for the {project,admin}
builds page without scope.
Fix a regression on !2243 (#4240).
See merge request !4118
* master:
Move CI admin builds and runners specs to correct directory
Fix 500 when viewing specific runners on runners page
Fix Ci::Project migration not migrating columns that cannot be NULL
Fix MySQL migration of CI emails
Minor fix in flow 'Merge when build succeeds'
Modifies the existing "login as" feature to be called impersonation, as
well as keeping track of who is impersonating to revert back to that
user without having to log out.
Adds a version requirement which it didn't have before, at 2.0.0. This
version has breaking API changes in that the namespace is now `FFaker`
instead of `Faker`.
“Can create groups” and “Can create teams” had hardcoded defaults to
`true`. Sometimes it is desirable to prohibit these for newly created
users by default.