Fix label `x` button showing for unauthorized users

The `x` button on labels incorrectly shows even for unauthorized
users. When unauthorized users click this the label is not removed
since there are backend authorization checks but this commit
fixes this UX inconsistency.

app/assets/javascripts/sidebar/components/labels/sidebar_labels.vue

@@ -77,7 +77,7 @@ export default {
 <template>
   <labels-select
     class="block labels js-labels-block"
-    :allow-label-remove="true"
+    :allow-label-remove="allowLabelEdit"
     :allow-label-create="allowLabelCreate"
     :allow-label-edit="allowLabelEdit"
     :allow-multiselect="true"

ee/app/assets/javascripts/epic/components/sidebar_items/sidebar_labels.vue

@@ -128,7 +128,7 @@ export default {
 
 <template>
   <labels-select-vue
-    :allow-label-remove="true"
+    :allow-label-remove="canUpdate"
     :allow-label-edit="canUpdate"
     :allow-label-create="true"
     :allow-multiselect="true"

spec/features/issues/user_edits_issue_spec.rb

@@ -13,6 +13,7 @@ RSpec.describe "Issues > User edits issue", :js do
   let_it_be(:milestone) { create(:milestone, project: project) }
   let_it_be(:milestones) { create_list(:milestone, 25, project: project_with_milestones) }
 
+  context 'with authorized user' do
     before do
       project.add_developer(user)
       project_with_milestones.add_developer(user)
@@ -330,4 +331,33 @@ RSpec.describe "Issues > User edits issue", :js do
         end
       end
     end
+  end
+
+  context 'with unauthorized user' do
+    before do
+      sign_in(user)
+    end
+
+    context "from issue#show" do
+      before do
+        visit project_issue_path(project, issue)
+      end
+
+      describe 'updating labels' do
+        it 'cannot edit labels' do
+          page.within '.block.labels' do
+            expect(page).not_to have_button('Edit')
+          end
+        end
+
+        it 'cannot remove label with a click as it has no `x` button' do
+          page.within '.block.labels' do
+            within '.gl-label' do
+              expect(page).not_to have_button
+            end
+          end
+        end
+      end
+    end
+  end
 end