widget.json endpoint of MRs exposes ci_status to unauthorized users.
This commit will add permission control of pipeline read access.