TodoService should not call `.select(&:id)` on todos, because this is
bad performance. So instead use sub-queries, which will result in a
single SQL query to the database.

https://docs.gitlab.com/ee/development/sql.html#plucking-ids

[9.3 security fix] Renders 404 if given project is not readable by the user on Todos dashboard

See merge request !2118

Instead of an integration test that creates 101 Todo records to test a
simple view helper, just unit test the helper.

This reverts merge request !10845

TodoService should not call `.select(&:id)` on todos, because this is
bad performance. So instead use sub-queries, which will result in a
single SQL query to the database.

https://docs.gitlab.com/ee/development/sql.html#plucking-ids

Fix for three open redirect vulns using redirect_to url_for(params.merge)))

See merge request !2082

This reverts merge request !10076

Added the ability to 'Undo mark all as done' todos marked as complete with 'Mark all as done'
in the 'Todo' tab of the Todo dashboard.
The operation undos only the todo previously marked as done with the 'Mark al as done' button.