Promoting milestone was missing an authorization check, guest
users were being able to promote project milestones to group milestones.