fix #35290 Make read-only API for public merge requests available without authentication

What does this MR do?

try to fix #35290 (closed)

Are there points in the code the reviewer needs to double check?

check if this is the proper fix. also check if secure

Why was this MR needed?

public merge requests accessible with ui without authentication should also accessible with API

Screenshots (if relevant)

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• Documentation created/updated
• API support added
• Tests
  • Added for this feature/bug
  • All builds are passing
• Review
  • Has been reviewed by UX
  • Has been reviewed by Frontend
  • Has been reviewed by Backend
  • Has been reviewed by Database
• Conform by the merge request performance guides
• Conform by the style guides
• Branch has no merge conflicts with master (if it does - rebase it please)
• Squashed related commits together

What are the relevant issue numbers?

#35290 (closed)