Impersonation support in CI tunnel

Cannot be enabled for now (should be done after !434 (merged)), but all code is in place. This MR can be merged because the user cannot configure the impersonation and hence cannot run into issues. I'd like to merge it because I'd like to continue working on it - finish coding gitlab-org/gitlab#327849 (closed) and gitlab-org/gitlab#327410.

This MR implements most of gitlab-org/gitlab#327412 (closed) but does not close the issue because, as explained above, ability to configure the feature is disabled for the user.