[api] move write permission checks from controller to package and project model

This is just the first part doing the checks. Removing the old ones is another step.