Fix forbidden_project_ids query

The project access flag has two status: "enable" and "disable" - the latter
must be queried for forbidden_project_ids.

The current code will add projects with any access flag (including access = enable)  to the forbidden_project_ids.