Add additional scope check to Todo#for_target spec

This works around a condition where the Issue and the MergeRequest
created by FactoryBoth both had the same ID, which caused `for_target`
to return two records when we only expected one.