Add missing security specs for raw snippet access

Each project visibility type (Public, Internal, Private) has an access
feature spec to catch security regressions. This commit adds relevent
tests for the raw snippet path in each of these project access specs.

Refacotrings:

- Use an empty project factory for access specs