As graphQL enforces pagination (with a maximum of 100 records,
we do not need to enforce the use of start/end arguments).

We show timelogs through the web UI to anyone who can access
an issuable, so we should observe the same permissions via
graphQL.

This is a pre-cursor to exposing timelogs against projects.

Changelog: changed