Use with_repo_branch_commit instead of fetch_ref directly

So that we could limit the access to Repository#fetch_ref
See: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/13416#note_37487433

app/models/merge_request.rb

@@ -940,14 +940,13 @@ class MergeRequest < ActiveRecord::Base
   private
 
   def write_ref
-    if for_fork?
-      target_project.repository.fetch_ref(
-        source_project.repository.path_to_repo,
-        "refs/heads/#{source_branch}",
-        ref_path
-      )
+    target_project.repository.with_repo_branch_commit(
+      source_project.repository, source_branch) do |commit|
+        if commit
+          target_project.repository.write_ref(ref_path, commit.sha)
         else
-      source_project.repository.write_ref(ref_path, source_branch_sha)
+          raise Rugged::ReferenceError, 'source repository is empty'
+        end
       end
   end
 end

spec/requests/api/merge_requests_spec.rb

@@ -583,8 +583,7 @@ describe API::MergeRequests do
       before do
         fork_project.add_reporter(user2)
 
-        allow_any_instance_of(Repository).to receive(:fetch_ref) # for forks
-        allow_any_instance_of(Repository).to receive(:write_ref) # for non-forks
+        allow_any_instance_of(MergeRequest).to receive(:write_ref)
       end
 
       it "returns merge_request" do