Changeset events for gitlab merge and close events not inferrable from notes

Created by: eseliger

For GitLab, we don't get a "timeline" via the API like we do for github, so we rely on gitlab system notes to sanitize the events we care about. While for the webhooks we do have sanitization of merged/closed events in place, we don't do so for the notes. That is, because GitLab doesn't return those in the list of notes, albeit they exist in the rendered UI. The only two options I see at this point are:

The simple, quick, dirty and ugly one:

• Sanitize the merged event based on the merged_at and merged_by fields from the MergeRequest API response (since merge is a one-way road, no "un-merge" can happen and this is safe)
• Sanitize the closed event based on closed_at and closed_by (this is not ideal, because we would overwrite historic state on reopen/close again and would not be able to reconstruct the whole timeline of the MR, especially for imported ones)

The hard, slow, clean and ugly one: Parse the HTML rendered by gitlab directly, and use those events. It works somewhat well and might be somewhat easy to detect breakage using a nightly run script test (in case of DOM changes). P o c: (But that could mean that API tokens aren't enough anymore (probably can't access rendered HTML with an API token?))

I checked the GraphQL API as well and it seems like that one also doesn't reveal the information we need.