GitLab

Fix https://gitlab.com/gitlab-org/gitlab-ce/issues/14607.

Discussed it here:
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/2831#note_4190228

The user has the rights of a public user execpt it can never create a project,
 group, or team. Also it cant view internal projects.

Prevent Groups to have smaller visibility than projects
Add default_group_visibility_level to configuration
Code improvements

This fixes the remainder of the GitPushService specs.

Closes #13663

Add the `read_build` ability if user is anonymous or guest and allow_guest_to_access_builds is enabled.

This MR simplifies CI permission model:
- read_build: allows to read a list of builds, artifacts and trace
- update_build: allows to cancel and retry builds
- create_build: allows to create builds from gitlab-ci.yml (not yet implemented)
- admin_build: allows to manage triggers, runners and variables
- read_commit_status: allows to read a list of commit statuses (including the overall of builds)
- create_commit_status: allows to create a new commit status using API

Remove all extra methods to manage permission.
Made all controllers to use explicitly the new permissions.

Also fix a few places where page_404 should be render_404.