Update the packages API

- Default status is None (all status allowed)
- Do not include the acl information in the returned json
Allow specifying a orphaned flag in the Package.search and specify if we want the ACLs in the json

- the orphaned flag allows specifying if the packages should be == orphaned or != orphaned
- to_json now accepts an acls argument allowing to include or exclude the ACLs
   representation in the returned JSON (defaults to True)
When searching for a collections in the API, allows specifying multiple statuses
Forward the orphaned flag from the internal API into the model API
ACLs information are now removed when searching packages