- Arbitrary file creation leading to command execution
- .md file creation/deletion

Reported by Gabriel Campana.

Closes #2764

Also changes the avatar from a jpeg to a png, to allow for
transparent background. The indexed png is also smaller in size.

Note that at the moment the default avatar is only used when
the user requested a custom avatar and the custom avatar file
is not found (should never happen).

In the future the default avatar could be used as a default
return when by-mail avatar lookups fail too (both gravatar
and libravatar support passing a default)

use 'official' repo.Name instead of incoming repoName; to enforce
correct capitalisation

Add start count corrector for Repository.NumClosedIssues

- Prevent panic on creating notice if database is not available
- Prevent incorrect folder on Windows ("/" instead of "\")

Fix #2872

Make user search function look in username (lower_name), full name
(full_name) and primary email (email). This will benefit searching after
user in "explore", admin panel and when adding new collaborators.

- Fix go-gogs-client#10
- Related to #809

Both are possible on explore and admin panel

Collaborators have write access as default, and can be changed via repository
collaboration settings page to change between read, write and admin.

- Allow to delete current avatar

Use hand-written SQL to do complex query