checks: Demonstrate combinatorial explosion in `#commits_for()`

`#commits_for()` has a bug where commits are returned multiple times in
case they're reachable via multiple commits, leading to combinatorial
explosion. Add a testcase which demonstrates this bug.

spec/lib/gitlab/checks/changes_access_spec.rb

@@ -160,6 +160,51 @@ RSpec.describe Gitlab::Checks::ChangesAccess do
 
       it_behaves_like 'a listing of new commits'
     end
+
+    context 'with criss-cross merges' do
+      let(:new_commits) do
+        [
+          create_commit(newrev, %w[a1 b1]),
+          create_commit('a1', %w[a2 b2]),
+          create_commit('a2', %w[a3 b3]),
+          create_commit('a3', %w[c]),
+          create_commit('b1', %w[b2 a2]),
+          create_commit('b2', %w[b3 a3]),
+          create_commit('b3', %w[c]),
+          create_commit('c', [])
+        ]
+      end
+
+      let(:expected_commits) do
+        [
+          create_commit(newrev, %w[a1 b1]),
+          create_commit('a1', %w[a2 b2]),
+          create_commit('b1', %w[b2 a2]),
+          create_commit('a2', %w[a3 b3]),
+          create_commit('b2', %w[b3 a3]),
+          create_commit('b2', %w[b3 a3]),
+          create_commit('a2', %w[a3 b3]),
+          create_commit('a3', %w[c]),
+          create_commit('b3', %w[c]),
+          create_commit('b3', %w[c]),
+          create_commit('a3', %w[c]),
+          create_commit('b3', %w[c]),
+          create_commit('a3', %w[c]),
+          create_commit('a3', %w[c]),
+          create_commit('b3', %w[c]),
+          create_commit('c', []),
+          create_commit('c', []),
+          create_commit('c', []),
+          create_commit('c', []),
+          create_commit('c', []),
+          create_commit('c', []),
+          create_commit('c', []),
+          create_commit('c', [])
+        ]
+      end
+
+      it_behaves_like 'a listing of new commits'
+    end
   end
 
   def create_commit(id, parent_ids)