Notes are awardables
## What does this MR do?
Makes sure we can :thunder_cloud_rain: comments/notes.
## What are the relevant issue numbers?
Follows up upon !2901, depends on !3785Closes#3655
## Screenshots (if relevant)
TODO
See merge request !4291
- Move the `TwoFactorAuthsController`'s `new` action to `show`, since
the page is not used to create a single "two factor auth" anymore. We
can have a single 2FA authenticator app, along with any number of U2F
devices, in any combination, so the page will be accessed after the
first "two factor auth" is created.
- Add the `u2f` javascript library, which provides an API to the
browser's U2F implementation.
- Add tests for the JS components
Upgrade devise, devise-two-factor, and attr_encrypted
Devise 4 includes support for Rails 5, working towards #14286. devise-async doesn't support Devise 4.0 and in 4.1 the bug that was blocking using Devise's built-in ActiveJob integration was fixed. So devise-async is removed. devise-two-factor 3.0.0 is required for Devise 4 support.
attr_encrypted and encryptor are optional but recommended upgrades for devise-two-factor 3.0.0. The mode and algorithm will need to be changed in order to update to attr_encrypted 4.x in the future.
See merge request !4216
Enable Style/NegatedIf Rubocop cop
Favor `unless` over `if` for negative conditions (or control flow ||).
```ruby
# bad
do_something if !some_condition
# bad
do_something if not some_condition
# good
do_something unless some_condition
# good
some_condition || do_something
```
See #17478
See merge request !4355
Loads move issue dropdown async
To keep the style of the dropdown the same as the other dropdowns in the issue form, it uses select2 rather than our new dropdowns.

Closes#16563
See merge request !4160
Since we eager load everything in lib/ putting ERB code in .rb files
will result in syntax errors. By moving the templates to
./generator_templates we can work around this.
fix#15127 ActiveJob::DeserializationError thrown
`send_devise_notification` pre-maturely enqueued the task when the user instance
has not yet been committed into the database, causing a record-not-found in the
other sidekiq process.
`devise-async` has already been taking care of asynchronous mail sending, we just
need to run it inside queue `mailers` instead of `mailer` to enable it.
The implementation of `devise-async` enqueues the task in `after_commit` hook
which is the right way to do it.
See merge request !3647