Make sure that :no_one_can_create is the only access

This is not needed for CE, because it's a 1 to 1 mapping,
but in EE it's not, so we need to make sure that we're
testing against :no_one_can_create

spec/services/ci/create_pipeline_service_spec.rb

@@ -532,6 +532,7 @@ describe Ci::CreatePipelineService, :services do
         context 'when no one can create the tag' do
           let!(:protected_tag) do
             create(:protected_tag,
+                   :remove_default_access_levels,
                    :no_one_can_create,
                    project: project,
                    name: ref)