Update predicate to check read_licenses claim

* test: add spec to recreate the bug
* docs: add changelog entry

ee/app/serializers/ee/merge_request_widget_entity.rb

@@ -35,7 +35,7 @@ module EE
         merge_request.enabled_reports
       end
 
-      expose :license_scanning, if: -> (mr, _) { head_pipeline_downloadable_path_for_report_type(:license_scanning) } do
+      expose :license_scanning, if: -> (mr, _) { can?(current_user, :read_licenses, mr.target_project) } do
         expose :managed_licenses_path do |merge_request|
           expose_path(api_v4_projects_managed_licenses_path(id: merge_request.target_project.id))
         end

ee/changelogs/unreleased/208723-load-license-url.yml

+---
+title: Load license scanning widget data when the `read_licenses` claim is satisfied
+merge_request: 44464
+author:
+type: fixed

ee/spec/serializers/merge_request_widget_entity_spec.rb

@@ -161,20 +161,17 @@ RSpec.describe MergeRequestWidgetEntity do
 
   describe '#license_scanning', :request_store do
     before do
-      allow(merge_request).to receive_messages(head_pipeline: pipeline, target_project: project)
       stub_licensed_features(license_scanning: true)
     end
 
-    it 'is not included, if missing artifacts' do
-      expect(subject.as_json).not_to include(:license_scanning)
-    end
-
     context 'when report artifact is defined' do
       before do
         create(:ee_ci_build, :license_scanning, pipeline: pipeline)
       end
 
       it 'is included' do
+        allow(merge_request).to receive_messages(head_pipeline: pipeline, target_project: project)
+
         expect(subject.as_json[:license_scanning]).to include(:can_manage_licenses)
         expect(subject.as_json[:license_scanning]).to include(:full_report_path)
       end
@@ -202,6 +199,14 @@ RSpec.describe MergeRequestWidgetEntity do
           expect(subject.as_json[:license_scanning]).to include(:settings_path)
         end
       end
+
+      context "when a report artifact is produced from a forked project" do
+        let(:source_project) { fork_project(project, user, repository: true) }
+        let(:fork_merge_request) { create(:merge_request, source_project: source_project, target_project: project) }
+        let(:subject_json) { described_class.new(fork_merge_request, current_user: user, request: request).as_json }
+
+        specify { expect(subject_json).to include(:license_scanning) }
+      end
     end
 
     describe '#managed_licenses_path' do