Rough envelope math reasoning here:

  - 100k sure does seem like a pretty massive default.
  - On a quick sampling of long-time users of various code forges, people
    tend to have < 150 repos.
  - Pad out with an extra 100 on the theory people might fork a whole
    lot of extensions etc.

This can of course be revisited.

I was going through policy stuff here:

https://www.mediawiki.org/wiki/GitLab/Policy#Permissions

...and noticed we'd written this:

> The "Pipelines" setting in public namespaced projects should be
> set to "Only Project Members". This ensures that only project
> members with Reporter privileges are able to run tests on a
> particular project.

I believe that's what's now under Project -> Settings -> Visibility,
project features, permissions -> CI/CD.  I'm not _totally_ sure what
effect this has, so I guess we'll need to experiment here, and may want
to make it optional on a per-project basis.

This also makes the project settings updates only do a single write per
changed project.

The project configuration stuff should be rolled into the `settings` CLI
elsewhere in this repo, but I'll save that for a later MR.

Uses click's ability to create a file handle from an option, adds a
settings-replica.yaml.

See README.md for an example.

This is still a little clunky and repetitive, code-wise, but a nicer
interface.

The `settings` script now has 3 subcommands:

    diff    Show differences between instance and settings.yaml
    update  Update settings on instance to match local settings.yaml.
    view    Show all instance settings.

Additionally, it takes parameters for instance URL and token, which can
also be specified by environment variables.

Background:

  - https://click.palletsprojects.com/en/8.0.x/
  - https://pypi.org/project/click/

This change matches existing settings, and is thus a no-op.  Tested
against existing configuration.

`configure-projects` uses the python-gitlab project to loop over all
projects in the instance and disable issues and wikis.

This also adds a requirements.txt and some rudimentary instructions in the
README.

Moves user-facing commands and configuration to top of repo, moves a few
common functions into a util.py.

Make `apply-settings` send JSON in the request body, which enables us to
set values that take an array.

Use that to handle restricted_visibility_levels and import_sources.

This commit reflects the current state of production settings.

Bug: T284336

Remove reference to wmf-gitlab-tools.

This seems like a better user experience overall than getting sent with no
explanation to an IDP login form.