Can retire a package: the POC or an admin unless the poc is a group or the package is orphaned
Add unit-test making sure user X cannot retire package of user Y