Show referenced MR in issues only when the current viewer can access it

This address the first issue identified in #6066 (closed).

Two remarks:

• I struggled a bit with the spinach steps dissemination so I chose to put all the steps I needed to test this fix in a new file;
• I will comment my code for the other remark ;)

The private MR by user remy2 with a note referencing to a public issue

The public issue viewed by user remy who doesn't have access to remy2/private-project before the fix

The public issue viewed by user remy who doesn't have access to remy2/private-project with the fix

The public issue viewed by user remy2 with the fix

I struggled a bit with the spinach steps dissemination so I chose to put all the steps I needed to test this fix in a new file;

I think it'd be best to go back and try to use the steps that are already written.

Added 1 commit:

• 78d847c3 - Move some specs from MRs to Issues specs

@rspeicher I've tried but the new steps I've created are very specific to the use-case I'm testing and I couldn't reuse steps without changing A LOT of code in unrelated tests, which is not the purpose of this MR.

Also, I didn't want to put the steps in shared/issuable.rb since they're used only once for now.

That said, I've moved the specs from project/merge_requests/notes.feature to project/issues/referenced_merge_requests.feature which is more appropriate since I'm testing the presence of referenced MR in an issue.

@rspeicher @DouweM I'm closing this MR in favor of !2405 (merged) which fix both bugs found in #6066 (closed).

Status changed to closed

@rymai Thanks for the explanation, sounds good. 👍