Fix various trivial problems (#36953)

1. remove `TEST_CONFLICTING_PATCHES_WITH_GIT_APPLY`
* it defaults to false and is unlikely to be useful for most users (see
#22130)
* with new git versions (>= 2.40), "merge-tree" is used,
"checkConflictsByTmpRepo" isn't called, the option does nothing.
2. fix fragile `db.Cell2Int64` (new: `CellToInt`)
3. allow more routes in maintenance mode (e.g.: captcha)
4. fix MockLocale html escaping to make it have the same behavior as
production locale

routers/common/maintenancemode.go

@@ -7,29 +7,39 @@ import (
 	"net/http"
 	"strings"
 
+	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/setting"
 )
 
-func isMaintenanceModeAllowedRequest(req *http.Request) bool {
-	if strings.HasPrefix(req.URL.Path, "/-/") {
-		// URLs like "/-/admin", "/-/fetch-redirect" and "/-/markup" are still accessible in maintenance mode
-		return true
-	}
-	if strings.HasPrefix(req.URL.Path, "/api/internal/") {
-		// internal APIs should be allowed
-		return true
-	}
-	if strings.HasPrefix(req.URL.Path, "/user/") {
-		// URLs like "/user/signin" and "/user/signup" are still accessible in maintenance mode
-		return true
-	}
-	if strings.HasPrefix(req.URL.Path, "/assets/") {
-		return true
-	}
-	return false
-}
-
 func MaintenanceModeHandler() func(h http.Handler) http.Handler {
+	allowedPrefixes := []string{
+		"/.well-known/",
+		"/assets/",
+		"/avatars/",
+
+		// admin: "/-/admin"
+		// general-purpose URLs: "/-/fetch-redirect", "/-/markup", etc.
+		"/-/",
+
+		// internal APIs
+		"/api/internal/",
+
+		// user login (for admin to login): "/user/login", "/user/logout", "/catpcha/..."
+		"/user/",
+		"/captcha/",
+	}
+	allowedPaths := container.SetOf(
+		"/api/healthz",
+	)
+	isMaintenanceModeAllowedRequest := func(req *http.Request) bool {
+		for _, prefix := range allowedPrefixes {
+			if strings.HasPrefix(req.URL.Path, prefix) {
+				return true
+			}
+		}
+		return allowedPaths.Contains(req.URL.Path)
+	}
+
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
 			maintenanceMode := setting.Config().Instance.MaintenanceMode.Value(req.Context())