Unauthorized user can access pipeline schedule variables

See merge request gitlab-org/security/gitlab!1028