When permissions to modify MR merge approval settings are
denied (i.e. project is regulated under compliance label), API request
to update these settings should be ignored. The current implementation
has a bug where the global `params` are mutated but then another
instance of `params` is returned, which results in no-op filtering
effect.

This MR is to ensure the method just use the `params` in the method
argument and avoid undesirable mutation of global `params`. The tests
are also refactored to improve coverage.