Fork MRs target least visible project

Previously, if a user forked a Public project and made their fork Private, opening a merge request in the fork would target the source project (the Public one) by default, potentially exposing private code.

Now, when the fork project is less visible than its source, we default to targeting the fork.

Related: #39051 (closed)