[api] do not allow random users to declare to maintain projects anymore

This is not a security problem, but it can create confusions when too many
projects claiming to maintain certain projects