EE 10161 hide issuable urls on vulnerability feedback

What does this MR do?

Hides the merge_request_path and the issue_url when the user doesn't have the appropriate permissions to view the corresponding merge request/issue.

This resolves issue #10161 (closed).