Do not try to auto-complete vulnerabilities if the user is nil

What does this MR do and why?

This usually happens when the user signouts from a different browser tab and then tries to add a note to an issue with the [vulnerability: prefix in it.

My initial idea was to add an authorization check to the controller layer and respond with "HTTP 403 or 404" but this breaks the client-side logic.

Screenshots

After this fix, the loading indicator gets removed correctly;

Before this fix(and the same if we try to apply authorization on controller layer), the loading indicator stays after the HTTP request completes;

Related to #346247 (closed)(https://sentry.gitlab.net/gitlab/gitlabcom/issues/2953033).

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.