/api/v4/allowed returns proper HTTP status codes

* Previously, a 200 (OK) was sent when the user was unauthorised or the project was not found (or the user didn't have access)
* We still treat 401 and 404 as 'success' but we need to explicitly handle them

lib/gitlab_net.rb

@@ -35,7 +35,8 @@ class GitlabNet # rubocop:disable Metrics/ClassLength
     url = "#{internal_api_endpoint}/allowed"
     resp = post(url, params)
 
-    if resp.code == '200'
+    case resp.code.to_s
+    when HTTP_SUCCESS, HTTP_UNAUTHORIZED, HTTP_NOT_FOUND
       GitAccessStatus.create_from_json(resp.body)
     else
       GitAccessStatus.new(false,