Fix bug where non-project members of the target project could set labels on new merge requests.

Fixes #2292 (closed).

cc @mrtux