bring available watchers in line with assignees etc

- endpoint also scoped by project
- thus also returning all possible watchers, not only the ones "not
watching"

[ci skip]
clarification on 403/404 of available xxx

[ci skip]