Splits auto-refreshing of MR widget into 2 requests:

- the one which uses etag-caching and invalidates the fields on change
- the one without caching

The idea is to gradually move all the fields to etag-cached endpoint

The actions tracked in the web IDE are:
- creation of commits
- creation of merge requests
- projects loaded

MergeRequest#all_pipelines fetches Ci::Pipeline records from the source
project, so we should specifically check that project for permissions.
This was already happening for intra-project merge requests, but in the
event that the target and source projects both have private builds, we
should ensure that the project permissions are respected.

This commits extracts /merge_requests/1.json?serializer=widget
Into a separate /merge_requests/1/widget.json endpoint
This will allow to use caching for this request

This MR is a backport of an EE merge request

Backports https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/10161
(code out of ee/ folder).

- concerns
- dashboard
- groups
- import

This style change enforces `return if ...` instead of
`return nil if ...` to save maintainers a few minor review points

Fixes a master failure due to a reduction in
the accepted Gitaly query count.

These specs were flaky and only passing after a retry due to how
rspec-retry works.

1. The test with paths that don't exist was returning 200 on the first
  try, then 404 on the second, not because the paths don't exist, but
  because the MR IID didn't change, thus the MR couldn't be found.
  I decided to remove the test entirely since we don't seem to return
  404 for paths that don't exist.
2. The test with a user that cannot view the merge request was failing
  the first time because the project owner wasn't removed with
  `project.team.truncate`.
  Changing the `let(:user)` to `create(:user)` and calling
  `project.add_maintainer(user)` in the `before` block fix the test.
Signed-off-by: NRémy Coutable <remy@rymai.me>

Allow single tasks to be updated quickly