fixes gitlab.com issue #506 - Asignee for Issuables not checked

As seen in https://gitlab.com/gitlab-org/gitlab-ce/issues/506, the assignee of an Issue and/or MergeRequest wasn't checked for permission on the project.

This PR comes with enhanced specs in both `Issue` and `Mergerequest`. These
two models are the only users of `Issuable` as far as I see. The
validation method needs to be overwritten in both of them as the
iactual implementation of permissions is unknown in the Issuable Concern
module.