Add CHANGELOG entry

changelogs/unreleased/security-11-10-mr-head-pipeline-leak.yml

+---
+title: Gate MR head_pipeline behind read_pipeline ability.
+merge_request:
+author:
+type: security