deleted packages (state=deleted) cannot be read by the owner

This causes the v1/2 REST package update API to fail with access denied because after successfully updating the package, the user no longer has permission to read it to generate the dict-like response.

Revised the auth logic to treat 'deleted' like 'draft', meaning only editors can read these packages.

Maybe there's a better way to do this.