feat: self-hosted GitLab Apps OAuth integration

Adds self-hosted GitLab OAuth sources so Coolify can connect to a self-managed GitLab instance, list private repositories, clone over an OAuth token, and deploy (the GitLab counterpart to GitHub Apps).

Hardening: authenticated, one-time team-bound OAuth callback state; token redaction in deploy logs; custom host port/path kept in clone and ls-remote URLs; submodule OAuth auth; system-wide source selection. Covered by unit and feature tests.

cosigned by OpenAI Codex at M1 Max

database/migrations/2026_06_03_000000_add_oauth_fields_to_gitlab_apps_table.php

@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('gitlab_apps', function (Blueprint $table) {
+            $table->longText('client_id')->nullable()->after('app_secret');
+            $table->longText('client_secret')->nullable()->after('client_id');
+            $table->longText('access_token')->nullable()->after('client_secret');
+            $table->longText('refresh_token')->nullable()->after('access_token');
+            $table->integer('expires_at')->nullable()->after('refresh_token');
+            $table->string('redirect_uri')->nullable()->after('expires_at');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('gitlab_apps', function (Blueprint $table) {
+            $table->dropColumn([
+                'client_id',
+                'client_secret',
+                'access_token',
+                'refresh_token',
+                'expires_at',
+                'redirect_uri',
+            ]);
+        });
+    }
+};