Show last_pipeline in commits API only if user can read pipeline

Closes #5

See merge request gitlab-org/security/gitlab!13