Make guests unable to view MRs
Description
The guest role does not allow for viewing of code, yet they can still see MRs.
Proposal
We revoke the ability to see MRs altogether for guests.
Links / references
From my understanding, the guest role is to allow people to create and comment on issues (such as to report bugs), but not view or pull code. If this is the case, then there is a discrepancy when it comes to merge requests.
As of now, a guest can view a diff of all changes associated with a merge request from the 'changes' tab. Given that a lot of projects require a MR before incorporating any changes, this seems like a glaring oversight, as a guest could possibly see the entire implementation of a feature, for instance.