Auditor user should also have private access

The permitted visibility levels for an auditor user should also include private,
because it has read-only access to every project/group on the GitLab instance.

lib/gitlab/visibility_level.rb

@@ -28,7 +28,7 @@ module Gitlab
       def levels_for_user(user = nil)
         return [PUBLIC] unless user
 
-        if user.admin?
+        if user.admin_or_auditor?
           [PRIVATE, INTERNAL, PUBLIC]
         elsif user.external?
           [PUBLIC]