Splits auto-refreshing of MR widget into 2 requests:

- the one which uses etag-caching and invalidates the fields on change
- the one without caching

The idea is to gradually move all the fields to etag-cached endpoint

MR pipeline permissions

Closes #2871

See merge request gitlab/gitlabhq!3204

The actions tracked in the web IDE are:
- creation of commits
- creation of merge requests
- projects loaded

MergeRequest#all_pipelines fetches Ci::Pipeline records from the source
project, so we should specifically check that project for permissions.
This was already happening for intra-project merge requests, but in the
event that the target and source projects both have private builds, we
should ensure that the project permissions are respected.

This commits extracts /merge_requests/1.json?serializer=widget
Into a separate /merge_requests/1/widget.json endpoint
This will allow to use caching for this request

This MR is a backport of an EE merge request

Backports https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/10161
(code out of ee/ folder).

- concerns
- dashboard
- groups
- import

This style change enforces `return if ...` instead of
`return nil if ...` to save maintainers a few minor review points

Fixes a master failure due to a reduction in
the accepted Gitaly query count.