Users have ability to fetch other projects' code via gitlab-ci-token.
This permission is controlled by "build_download_code".
However, this permission is not prevented when "repository_disabled"
for the users. This commit fixes this.