What does this MR do?
It enforces the :download_code permission in Event#visible_to_user? for commit notes.
I've also added note? && target && in Event#commit_note? and Event#project_snippet_note? for consistency with other similar methods.
Are there points in the code the reviewer needs to double check?
I think it makes sense since commits are visible if the current user has the :download_code ability, so a note of a commit should have the same restrictions.
Closes #23824 (closed)