Require read_code instead of download_code for note access

Jerry Setorequested to merge
376180-separate-view-code-permission-from-download-code-create-2-permissions-2 into master

What does this MR do and why?

Require read_code instead of download_code for note access

The abilities that read_code should allow are intended to be a subset of those of download_code so this should not have any user impact for now.

Contributes to: #376180 (closed)

How to set up and validate locally

  1. Create a private project
  2. Comment on a commit for that project
  3. Search for the comment and see that a result is found
  4. Add a user as a guest to that project
  5. Using the guest user try to search for the comment and see that no results are found

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #376180 (closed)

Edited by Jerry Seto

Merge request reports