Inform a user that MR from private fork to public project will disclose path and branch of this private project

It first appeared as a security issue: #35203 (closed). However, there has been a point raised that we may better fix it via UI enhancement accepting that a public merge request must disclose some details about the source: #35203 (comment 294725293)