[api] use defined ordering for user/group role definitions in project and package meta

We did depend on the database sql result order so far