Show referenced MR in issues only when the current viewer can access it

This address the first issue identified in #6066 (closed).

Two remarks:

• I struggled a bit with the spinach steps dissemination so I chose to put all the steps I needed to test this fix in a new file;
• I will comment my code for the other remark ;)

The private MR by user remy2 with a note referencing to a public issue

The public issue viewed by user remy who doesn't have access to remy2/private-project before the fix

The public issue viewed by user remy who doesn't have access to remy2/private-project with the fix

The public issue viewed by user remy2 with the fix