### Problems to solve When users update the MR approval settings that are locked from the higher level (e.g. project settings that are locked by instance setting), the changes are discarded and the API returns 200 HTTP status. This does not give a clear indication to the client. ### Proposal When the MR approval settings are locked, the API should return 403 Forbidden. * If MR approval settings are locked at group or [instance-level](https://docs.gitlab.com/ee/user/admin_area/merge_requests_approvals.html), [updating the project-level](https://docs.gitlab.com/ee/api/merge_request_approvals.html#change-configuration) should return 403 * If MR approval settings are locked at [instance-level](https://docs.gitlab.com/ee/user/admin_area/merge_requests_approvals.html), updating the group-level should return 403