[19.0] CI: Authenticate gitlab.com clones via GIT_CONFIG_GLOBAL file

What does this MR do and why?

Backport of !9510 (merged) and !9504 (merged) to 19-0-stable.

That MR makes authenticated gitlab.com clones of gitlab-org/gitlab in CI actually work, so builds use the higher authenticated Gitaly rate limit instead of intermittently failing with GitLab is currently unable to handle this request due to load. It writes the git auth config (credential helper + path-scoped proactiveAuth) to a GIT_CONFIG_GLOBAL file in before_script -- where ${CI_JOB_TOKEN} actually exists -- and reverts the earlier URL-embedding workaround from !9501 (merged).

Note: the revert commit is a no-op on 19-0-stable because !9501 (merged) was never backported here, so lib/gitlab/version.rb has no URL-embedding to remove. The backport of !9510 (merged) itself therefore contains only the CI authentication change (the GIT_CONFIG_GLOBAL file in .gitlab-ci.yml and gitlab-ci-config/variables.yml). The only conflict was a YAML-quoting difference in variables.yml, resolved in favor of the 19-0-stable style.

Additional commits needed for 19-0-stable

proactiveAuth requires a git version (>= 2.46) that the builder image on 19-0-stable did not ship, so two extra commits were pulled in to make the authenticated clones actually work:

• Bump BUILDER_IMAGE_REVISION to 5.60.2 -- pulls in an updated ci_tools image whose git supports proactiveAuth (gitlab-omnibus-builder!479 (merged)). Without this bump, the generate-facts job frequently fails because it hits the rate limit for unauthenticated clones. The only change between 5.57.2 and 5.60.2 is that builder MR: gitlab-omnibus-builder@5.57.2...5.60.2
• Make package_size_check use the same image as generate-facts -- the generate-facts job now runs on a Debian Trixie based image (newer glibc), while package_size_check was still on Ubuntu 22.04 and reused the gems cached by generate-facts, so it failed with version GLIBC_2.38 not found. Aligning the images avoids the glibc incompatibility.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
• The original MR has been deployed to GitLab.com (not applicable for documentation or spec changes).
• This MR has a severity label assigned (if applicable).

Note to the merge request author and maintainer

If you have questions about the patch release process, please:

• Refer to the patch release runbook for engineers and maintainers for guidance.
• Ask questions on the #releases Slack channel (internal only).