[19.1] CI: Authenticate gitlab.com clones via GIT_CONFIG_GLOBAL file

What does this MR do and why?

Backport of !9510 (merged) and !9504 (merged) to 19-1-stable.

That MR makes authenticated gitlab.com clones of gitlab-org/gitlab in CI actually work, so builds use the higher authenticated Gitaly rate limit instead of intermittently failing with GitLab is currently unable to handle this request due to load. It writes the git auth config (credential helper + path-scoped proactiveAuth) to a GIT_CONFIG_GLOBAL file in before_script -- where ${CI_JOB_TOKEN} actually exists -- and reverts the earlier URL-embedding workaround from !9501 (merged).

This backport cherry-picks all three commits from the original MR cleanly; the only conflict was a YAML-quoting difference in gitlab-ci-config/variables.yml, resolved in favor of the 19-1-stable style.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
• The original MR has been deployed to GitLab.com (not applicable for documentation or spec changes).
• This MR has a severity label assigned (if applicable).

Note to the merge request author and maintainer

If you have questions about the patch release process, please:

• Refer to the patch release runbook for engineers and maintainers for guidance.
• Ask questions on the #releases Slack channel (internal only).