adds a validation for assignee in Issuable

comes with enhanced specs in both `Issue` and `Mergerequest`. These
two models are the only users of Issuable as far as I see. The
validation method needs to be overwritten in both of them as the
iactual implementation of permissions is unknown in the Issuable Concern
module.