[api] Fix forbidden_projects_ids query

The project access flag has two status: "enable" and "disable" - the latter
must be queried for forbidden_project_ids.
[api] move write permission checks from controller to package and project model