A new config object `encrypted` can be defined at any level and contain encrypted configuration strings. Initial use is for encrypting an npm token for use with the hosted renovate app.

Closes #650

Forward slash is replaced with %2F. It is assumed that this is backwards compatible with api v3 too.

Closes #749

Closes #757

GitLab 9.5 deprecates api v3 and `iid` must now be used for MRs

Renovate config can now support the fields `npmToken`, `npmrc` and `yarnrc`. `npmrc` and `yarnrc` (note no `.` prefix) can be used as an alternative to checking the respective files into the repo and have the same effect. `npmToken` is a shorter alternative and allows for just the npm token to be added, defaulting to the public npm registry.

Previously, the automerge feature was causing some undesirable behaviour when multiple branches were open at the same time. Example: #707. The main problem is that other branches will still be calculated based on the original `package.json` contents and not the post-merge contents. The simplest solution seems to be:
- Stop all subsequent branch processing after any automerge
- Restart repository renovation
This continues until no branch has automerged in a cycle.

Closes #750

We should not leave the PR unopened forever if the branch remains in not-pending state too long. Some status checks may leave the status as “pending” instead of “failed”. Defaults to 12 hours but is configurable.

Closes #747

Closes #626

This feature adds explicit support for correctly generating the yarn.lock file for workspaces. Specifically, it means that the yarn.lock in the root directory is regenerated whenever *any* package.json is modified. Previously lock files were only every updated if its corresponding package.json changes, but that is not the way yarn workspaces works.

Closes #473

The ignoreNodeModules feature is replaced with a generic ignorePaths one and allows any array of strings to be defined and package.json file matching them will be skipped/ignored. Also migrates any existing config/presets.

This is a major refactor of branch code to prepare for Yarn workspaces plus creating PRs for branches with failing lockfiles. Marked as "feature" to cause a minor version bump due to the moderate chance of accidentally breaking something.

Fixes #732

* fix: explicitly check automerge = true

* update presets fixtures and tests

* fix versions tests

* update tests

- reuse suffix for any “before and after” splits
- move “on every weekday” massage to migrate

- Split ‘x and y’ schedule into [x, y]
- Replace schedules like ’on mondays’ with ‘on monday’

Eliminating one more possibility for #707

Leave the rest to error.

tmpDir is now created once per-repository and package.json files are written and lockfiles generated based on the repo's directory structure. This way node_modules can be reused between branches in same run.

Closes #501

This makes for an uglier migration and potentially some redundancy, but is the only easy way to ensure that the migrated behaviour is definitely correct.

Fixes #713

Refactored the `automerge` field to change it to boolean. Existing string will be migrated to new config. Automerging lock files is now possible by adding `”lockFileMaintenance”: { ”automerge”: true}` to config.

Closes #706

Add check for pr.canRebase. This will be false if the PR has been modified.

Fixes #790

Previously, preset resolution was being done last, after merges of renoate.json or package.json config. This caused wrong ordering of config in cases where both presets + regular config was in use. Instead, resolving of presets is now done at each stage before merging.

Fixes #708