Change who can close work items when an MR is merged

This issue is a follow-up on the conversation we had in #468223 (comment 1969708519)

TL;DR

Before, we would create the hard links in the DB for any issue the MR author could read. Then, during merge, we check that the user merging the MR can update the autoclosing issue before closing. So around this I think my proposal will simply be moving checks from one place to another. We'll be more strict when creating the links in favor of not checking the user merging the MR can necessarily update one of the issues that will be closed (but this is the proposal I need to work on with appsec, we might need to store the user that creates the hardlink so we can check when closing too)