Fix permissions check to check on eventable

We need to check on eventable because the eventable may have more
specific policies. e.g. confidential issues

app/finders/resource_state_event_finder.rb

@@ -15,7 +15,7 @@ class ResourceStateEventFinder
   def can_read_eventable?
     return unless eventable
 
-    Ability.allowed?(current_user, read_ability, eventable.project)
+    Ability.allowed?(current_user, read_ability, eventable)
   end
 
   private