fix: use GitLab API v4 for OAuth and gate env copy by update policy

Socialite's GitLab provider fetches the user from /api/v3/user, which
GitLab removed in 11.0 (410 Gone). Add App\Auth\GitlabProvider that
reads /api/v4/user with a bearer token and register it in the
socialite helper, for both gitlab.com and self-hosted base URLs.

Environment variable copyValue now checks the 'update' policy on the
variable instead of the member role of the current team, so members
can no longer copy values after switching to a team they own. Remove
the redundant member check from ShowHardcoded.

Add tests for the GitLab v4 user lookup and the team-switch copy case.

tests/Feature/EnvironmentVariableCopyValueTest.php

@@ -123,6 +123,22 @@ test('members get no copy button and no value', function () {
         ->assertReturned(null);
 });
 
+test('members get no value after switching to a team they own', function (string $variableType) {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member, ['role' => 'member']);
+    $ownedTeam = Team::factory()->create();
+    $ownedTeam->members()->attach($member, ['role' => 'owner']);
+    $this->actingAs($member);
+    $env = $variableType === 'shared'
+        ? SharedEnvironmentVariable::create(['key' => 'TEAM_WIDE', 'value' => 'team-wide-secret', 'type' => 'team', 'team_id' => $this->team->id])
+        : createEnvironmentVariable();
+
+    $component = Livewire::test(Show::class, ['env' => $env, 'type' => 'application']);
+    session(['currentTeam' => $ownedTeam]);
+
+    $component->call('copyValue')->assertReturned(null);
+})->with(['application variable' => 'application', 'shared variable' => 'shared']);
+
 test('locked variables get no copy button and no value', function () {
     Livewire::test(Show::class, ['env' => createEnvironmentVariable(['is_shown_once' => true]), 'type' => 'application'])
         ->assertDontSeeHtml('Copy value')