GitLab is hosted in the US and also must comply with the same US laws. When GitLab moved to GCP this issue came up because Google geo fences the embargoed countries: https://about.gitlab.com/2018/07/19/gcp-move-update/
GitLab is a US company. Although you can self host an instance wherever you want.
GitLab.com is hosted in the US. The GitLab on prem software can be hosted wherever the hell you want
Can you get GitLab on-prem if you're in a sanctioned country though, or is GitLab also not allowed to let you download it if that's where you're located?
Since at its core it's free software, you can download it from wherever you want.
But since US companies are forced to geo-restrict, how can you verify that the (free) software you've downloaded, is actually the free software offered by those companies?
With their signatures, commit hashes and distribution networks you trust (such as distro maintainers, for instance).
You most likely already do that without any sanctions that affect you.