Perform merge without required jobs started (External job and detached pipeline)

Summary

Since GitLab CE 11.10, external jobs are no longer attached to merge_requests pipeline (with the detached badge). If the external job succeeds, the manual jobs defined as mandatory (only: merge_requests, allow_failure: false) are no longer required to perform a merge.

Steps to reproduce

1. Add .gitlab-ci.yml file (after create PRIVATE_TOKEN variable) :

stages:
  - test

.sonarqube:
  stage: test
  when: manual
  only:
    refs:
      - merge_requests
  script:
    # Create an external job
    - 'curl --request POST --header "PRIVATE-TOKEN: $PRIVATE_TOKEN" "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/statuses/${CI_COMMIT_SHA}?state=${COMMIT_STATE}&ref=${CI_COMMIT_REF_NAME}&name=sonarqube&description=${COMMIT_STATE}"'

sonarqube:failure:
  extends: .sonarqube
  variables:
    COMMIT_STATE: failed

sonarqube:success:
  extends: .sonarqube
  variables:
    COMMIT_STATE: success

################################################################################
# TEST
.compose:
  stage: test
  when: manual
  allow_failure: false
  only:
    refs:
      - merge_requests

Install:
  extends: .compose
  script:
    - echo "Install tests"

Update:
  extends: .compose
  script:
    - echo "Update tests"

2. Create au MR with change
3. The merge request is stuck waiting for manual action
   
4. Perform the manual job "sonarqube:success", who change commit status using the API
   
5. This action create two pipelines
   
6. (BUG) Now, you can merge MR even though the tasks Install and Update have not been started.
   

Example Project

• https://gitlab.com/baltazardoung/ci-external-from-detached/blob/master/.gitlab-ci.yml
• baltazardoung/ci-external-from-detached!1

What is the expected correct behavior?

In ours previous version of GitLab CE (11.9.4), the external job are attached to merge_requests pipeline and all mandatory manual jobs were required before merging.