fix [gitlab] auth

[calebcartwright]

Fixes the overwhelming majority, but not totality, of #8143.

I also added a dummy license to our private test repo under the shields-ops-group

[shields-ci]

	Warnings
⚠️	📚 Remember to ensure any changes to config.private in services/gitlab/gitlab-base.js are reflected in the server secrets documentation

	Messages
📖	✨ Thanks for your contribution to Shields, @calebcartwright!

Generated by 🚫 dangerJS against f0b2c5c

[calebcartwright]

Forgot to explicitly note, but the outstanding piece is the original circumstance that identified this issue. I provided more detail in #8143 (comment) but in short the Contributors badge doesn't utilize auth at all and will need a separate adjustment.

cc @sunny0826 in case you'd like to work on getting the Contributors badge adjusted to utilize the auth

[chris48s]

Just to confirm, passing the token in the password field using basic auth just flat-out doesn't work anymore - right?

[calebcartwright]

Just to confirm, passing the token in the password field using basic auth just flat-out doesn't work anymore - right?

Correct. I know I tested this back when I first added it so can only assume it worked at the time, but perhaps that was just legacy behavior GL had been planning on dropping for a while and that finally happened at some point over the last year.

Or perhaps my brain just mistakenly interpreted 404s as 200s 🤷‍♂️

[sunny0826]

Just to confirm, passing the token in the password field using basic auth just flat-out doesn't work anymore - right?

GitLab supports multiple authentication methods, but not user: "", pass: "", which was probably deprecated before I joined GItLab... I even I didn't even find it in the documentation for the old version

[calebcartwright]

To be honest I'm not sure the past really matters all that much at this point unless anyone has an operable time machine and use cases that predate the one surfaced this week.

Whether or not basic auth with a pat only ever worked with git doesn't really make a difference going forward; using the pat in the oauth header does, for now, and that's what we're now using