Race condition in GitLab import, giving access to other people their imports due to filename collision

Vulnerability details There's a race condition in the `Import::GitlabProjectsController#create` endpoint that allows an attacker to gain access to someone else's import file. The race condition happens when there's a collision in two or more file names uploaded at the same time, before the import …

import_upload_path = Gitlab::ImportExport.import_upload_path(filename: project_params[:file].original_filename)

FileUtils.mkdir_p(File.dirname(import_upload_path))
FileUtils.copy_entry(project_params[:file].path, import_upload_path)