Reorder protected_ref_access checks

The following discussion from !156664 (merged) should be addressed:

• @jwoodwardgl started a discussion:

  thought: This check should come first. If this deploy key user is not the current user then there's no point firing database queries in the can?(:read_project, project) call.

  I will add this in another MR