Authorize read_build when listing pipeline jobs

lib/api/jobs.rb

@@ -59,6 +59,8 @@ module API
       # rubocop: disable CodeReuse/ActiveRecord
       get ':id/pipelines/:pipeline_id/jobs' do
         pipeline = user_project.ci_pipelines.find(params[:pipeline_id])
+        authorize!(:read_build, pipeline)
+
         builds = pipeline.builds
         builds = filter_builds(builds, params[:scope])
         builds = builds.preload(:job_artifacts_archive, :job_artifacts, project: [:namespace])

spec/requests/api/jobs_spec.rb

@@ -251,12 +251,22 @@ describe API::Jobs do
     end
 
     context 'unauthorized user' do
+      context 'when user is not logged in' do
         let(:api_user) { nil }
 
         it 'does not return jobs' do
           expect(response).to have_gitlab_http_status(401)
         end
       end
+
+      context 'when user is guest' do
+        let(:api_user) { guest }
+
+        it 'does not return jobs' do
+          expect(response).to have_gitlab_http_status(403)
+        end
+      end
+    end
   end
 
   describe 'GET /projects/:id/jobs/:job_id' do