[api, webui] remove change_role in API and add a relationships controller

This makes the API routes clearer and the webui code uglier, but it's a
step in the right direction of clearer controllers in API
[api] create one unified relationship model

move the relationships of [user|group] and [package|project] into
one table
[api] optimize loading maintainers in /status/project