require package name permissions to use a dist name

This implements the long-discussed rule:

* To upload a distribution named "Xyz" you must have permission on package "Xyz."
* …and it's okay if you only *get* that permission by the upload under consideration.

The grandfather list needs to be fleshed out.  We can do that programatically.