Populate CommitCollection from target project/branch

Currently the commitsWithoutMergeCommits node list of the graphql
mergeRequest field is not populated if the _source_ project is not
accessible by the user. This is wrong and a break from the behaviour of
the existing REST API.

Fix this in the MergeRequestDiff object's load_commits() function by
populating the CommitCollection from the _target_ project and branch
instead. Otherwise the collection is determined to be inaccessible to
the user.

Fixes: https://gitlab.com/gitlab-org/gitlab/-/issues/335687
Changelog: fixed
Signed-off-by: Patrick Talbert <ptalbert@redhat.com>

app/models/merge_request_diff.rb

@@ -710,7 +710,7 @@ class MergeRequestDiff < ApplicationRecord
     end
 
     CommitCollection
-      .new(merge_request.source_project, commits, merge_request.source_branch)
+      .new(merge_request.target_project, commits, merge_request.target_branch)
   end
 
   def save_diffs

spec/models/merge_request_diff_spec.rb

@@ -1080,6 +1080,22 @@ RSpec.describe MergeRequestDiff do
     end
   end
 
+  describe '#commits' do
+    include ProjectForksHelper
+
+    let_it_be(:target) { create(:project, :test_repo) }
+    let_it_be(:forked) { fork_project(target, nil, repository: true) }
+    let_it_be(:mr) { create(:merge_request, source_project: forked, target_project: target) }
+
+    it 'returns a CommitCollection whose container points to the target project' do
+      expect(mr.merge_request_diff.commits.container).to eq(target)
+    end
+
+    it 'returns a non-empty CommitCollection' do
+      expect(mr.merge_request_diff.commits.commits.size).to be > 0
+    end
+  end
+
   describe '.latest_diff_for_merge_requests' do
     let_it_be(:merge_request_1) { create(:merge_request_without_merge_request_diff) }
     let_it_be(:merge_request_1_diff_1) { create(:merge_request_diff, merge_request: merge_request_1, created_at: 3.days.ago) }