Show referenced MRs & Issues only when the current viewer can access them
This addresses both issues identified in #6066.
## The private MR by user `remy2` with a note referencing to a public issue

---
## The public issue viewed by user `remy` **who doesn't have access to `remy2/private-project`** before the fix

---
## The public issue viewed by user `remy` **who doesn't have access to `remy2/private-project`** with the fix

---
## The public issue viewed by user `remy2` with the fix (no change)

See merge request !2405
Create a new shared module for common issue/merge request behavior,
use `expect` syntax instead of `should`, and avoid `visible: false` in
the `have_css` matcher.