Do not expose starred projects of users with private profile via API

See merge request gitlab-org/security/gitlab!1075