Restrict User/Project ref filter caches to applicable scenarios

Asherah Connorrequested to merge
push-ltzwspmyxqkv into master

What does this MR do and why?

Fixes It appears possible to generate cursed system n... (#589326 - closed) by restricting the cached_call uses in the User and Project reference filters to when there's no custom link text applied; otherwise, the first call's result is used for all subsequent uses, leading to the silliness shown there.

How to set up and validate locally

  1. Reproduce on your GDK using a similar example to the one given in #589326 (closed), using a user that exists on your GDK. Note the syntax: [some text here](@username) followed by @username.
  2. Also test with a project: [some text here](path/to/project>) followed by path/to/project>. These are per https://docs.gitlab.com/user/markdown/#gitlab-specific-references.
  3. After you've reproduced it, check this branch out.
  4. Edit wherever you reproduced it. Markdown is cached in the database, so if you don't edit and save an actual change to the content, it won't get re-rendered and nothing will change.
  5. Check that, after editing, only the links with custom text have the custom text applied, and the 'bare' references still work but just show their reference as the text, like normal!

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports