deleted packages (state=deleted) cannot be read

This causes the v1/2 REST package update API to fail with access denied
because after successfully updating the package, the user no longer
has permission to read it to generate the dict-like response.

Revised the auth logic to treat 'deleted' like 'draft', meaning
only editors can read these packages.