[api] rework how subscriptions work

We need to be able to have multiple roles per event - and let users override
them. The previous model only allowed one role per event, which might have been
'none'

But if users want to still get mails for 'creator' role, but ignore 'maintainer',
they need to be able to black out 'maintainer' without touching 'creator' role

For now I do not support specifics for project and packages - will readd
this later
[api] support comment events better