This commit fixes an issue where only users able to read cross-project
would receive project-scoped emails (CI failures, MR notifications,
etc.)

It does this by only requiring the user to have cross-project read
access for notifications that *aren't* scoped to an individual project.
This allows notifications to be sent in most cases without putting any
significant extra load on the external authorization server.

Changelog: fixed