Public projects can restrict access to pipeline.
However, metrics_reports endpoint is publicly accessible
even it is restricted in UI.

This commit:
- adds metrics_reports to authorize_read_pipeline! filter.
- adds and refactor tests