Merge branch 'dont-notify-users-without-project-access' into 'master'

Don't notify users without access to the project when they are (accidentally) mentioned in a note.

Addresses #2366.

See merge request !1216