Limit the merge request target branch autocompletion action to group or project scope

What does this MR do?

Querying target branches visible to a user is an expensive operation, and it reliably times out when attempting to run it globally (i.e., without a group or project restriction).

No genuine clients actually need this global operation - the endpoint is used only in filtered search, which is itself only used in group or project scope.

Since we always send a group or project ID for genuine requests, we can simply refuse to serve requests lacking that, so we don't need to try to optimise the SQL we're doing for the global case.

Screenshots

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• [-] Documentation (if required)
• [-] Code review guidelines
• [-] Merge request performance guidelines
• [-] Style guides
• Database guides
• [-] Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.

Typical timings locally:

• No group_id or project_id: 80ms
• group_id: 500ms
• project_id: 100ms

Previously, the first case would take 15 seconds before the SQL query timed out.

Related to #31830 (closed)