- Fix go-gogs-client#10
- Related to #809

Both are possible on explore and admin panel

Collaborators have write access as default, and can be changed via repository
collaboration settings page to change between read, write and admin.

- Allow to delete current avatar

- Remove unused config settings `[picture] service`

- Migrate: #2704 #2653
- Clone: #2701
- Mirror, Pull

Improve test cases, config settings, also show SSH config settings on admin config panel.

Config option [server] SSH_LISTEN_PORT to the port the builtin SSH server will be listen.
It can be different from SSH_PORT which is supposed to be exposed in the clone URL.
This should solve the problem when user runs Gogs inside Docker container
and still want to use builtin SSH server.

DisableSSH doesn't check the kind of ssh server to use, so that was
wrong. Use StartSSHServer instead.

The contants were placed in the same section as the scheme ones, which
may lead to confusion.

Also fix a possible race condition while install

Make it easier to keep track of upstream changes and bug fixes

This is useful especially to check whether we fetch right attributes, using
right LDAP search base and in right order.

This is feature is workaround for #2628 (JumpCloud) and some other services
that allow LDAP search only under BindDN user account, but not allow any LDAP
search query in logged user DN context.

Such approach is an alternative to minimal permissions security pattern for
BindDN user.

According to RFC 4511 4.2.1. Processing of the Bind Request "Clients may send
multiple Bind requests to change the authentication and/or security
associations or to complete a multi-stage Bind process. Authentication from
earlier binds is subsequently ignored."

Therefore we should not use 2 connections, but single one just sending two bind
requests.

When <code> is nested inside <pre>, the next end tag token would not able to be the same
as outer-most start tag. So we only check outer-most start and end tag token to be the same.