Reported as a security issue originally, but recuded to a docs fix, it
is possible for Reporters to create a merge request by first forking
the project and then opening a merge request. This is consistent with
the fact that Reporters have permission to view and pull the repository
and that the point of the forking workflow is to allow anyone to
contribute while only requiring read permissions.

Additionally, it is possible for Guests to contribute to public
projects in the same way.