Cherry pick gitlab 16.11.5 update

Currently deployed to blue.servy.computer.surgery

This is a security update. The nixpkgs PR for the update is blocked on the darwin runners, which appear to be currently broken. I just cherry-picked that change on top of nixos-unstable into a nixpkgs fork for now. I remembered only after deploying this that the plan we talked about earlier today was depending on the PR branch as a separate flake input and setting services.gitlab.packages.* to use it. We could switch to that, but it does take a long time to build gitlab, so it would take a bit to deploy.

It looks like the nixos-unstable bump also pulled in changes to jellyfin.