Not checking node access on the project node when creating new issues

I was just testing project_issue_node_add() and discovered that as a regular user, if you manually visit node/add/project-issue/foo where foo is the machine name for an unpublished project, the node add form appears, discloses the node title of the parent project which the user shouldn't be able to see, and then the resulting node form always fails validation for the entityreference field. We should catch this error early and generate a 403 in this case, instead.

I've already got working code locally, just wanted to open an issue for a nid for the commit message and to document the bug.