Do not allow non-members to create MRs via forked projects when MRs are private

See merge request gitlab/gitlabhq!2368