Permission check issuable template API data

From https://gitlab.com/gitlab-org/gitlab/-/issues/336446:

> it seems possible that a customer might put some information in there
> that they would not want to be publicly known.

This change checks that a user can view issues, or merge requests, of a
project before exposing the default templates.

Changelog: security
EE: true

ee/lib/ee/api/entities/project.rb

@@ -37,8 +37,14 @@ module EE
           expose :compliance_frameworks do |project, _|
             [project.compliance_framework_setting&.compliance_management_framework&.name].compact
           end
-          expose :issues_template, if: ->(project, _) { project.feature_available?(:issuable_default_templates) }
-          expose :merge_requests_template, if: ->(project, _) { project.feature_available?(:issuable_default_templates) }
+          expose :issues_template, if: ->(project, options) do
+            project.feature_available?(:issuable_default_templates) &&
+              Ability.allowed?(options[:current_user], :read_issue, project)
+          end
+          expose :merge_requests_template, if: ->(project, options) do
+            project.feature_available?(:issuable_default_templates) &&
+              Ability.allowed?(options[:current_user], :read_merge_request, project)
+          end
           expose :merge_pipelines_enabled?, as: :merge_pipelines_enabled, if: ->(project, _) { project.feature_available?(:merge_pipelines) }
           expose :merge_trains_enabled?, as: :merge_trains_enabled, if: ->(project, _) { project.feature_available?(:merge_pipelines) }
         end

ee/spec/requests/api/projects_spec.rb

@@ -276,31 +276,59 @@ RSpec.describe API::Projects do
       end
     end
 
-    context 'issuable default templates feature is available' do
-      before do
-        stub_licensed_features(issuable_default_templates: true)
-      end
+    context 'issuable default templates' do
+      let(:project) { create(:project, :public) }
 
-      it 'returns issuable default templates' do
-        subject
+      context 'when feature is available' do
+        before do
+          stub_licensed_features(issuable_default_templates: true)
+        end
 
-        expect(response).to have_gitlab_http_status(:ok)
-        expect(json_response).to have_key 'issues_template'
-        expect(json_response).to have_key 'merge_requests_template'
-      end
-    end
+        it 'returns issuable default templates' do
+          subject
 
-    context 'issuable default templates feature not available' do
-      before do
-        stub_licensed_features(issuable_default_templates: false)
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response).to have_key 'issues_template'
+          expect(json_response).to have_key 'merge_requests_template'
+        end
+
+        context 'when user does not have permission to see issues' do
+          let(:project) { create(:project, :public, :issues_private) }
+
+          it 'does not return issue default templates' do
+            subject
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response).not_to have_key 'issues_template'
+            expect(json_response).to have_key 'merge_requests_template'
+          end
+        end
+
+        context 'when user does not have permission to see merge requests' do
+          let(:project) { create(:project, :public, :merge_requests_private) }
+
+          it 'does not return merge request default templates' do
+            subject
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response).to have_key 'issues_template'
+            expect(json_response).not_to have_key 'merge_requests_template'
+          end
+        end
       end
 
-      it 'does not return issuable default templates' do
-        subject
+      context 'issuable default templates feature not available' do
+        before do
+          stub_licensed_features(issuable_default_templates: false)
+        end
 
-        expect(response).to have_gitlab_http_status(:ok)
-        expect(json_response).not_to have_key 'issues_template'
-        expect(json_response).not_to have_key 'merge_requests_template'
+        it 'does not return issuable default templates' do
+          subject
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response).not_to have_key 'issues_template'
+          expect(json_response).not_to have_key 'merge_requests_template'
+        end
       end
     end