[api] fix first history entry detection in migration
[api] Refactor AnonymousUser exception into ForbidsAnonymousUsers module

This is a prerequisite to checking for anonymous user (be_not_nobody!) in
other places, e.g. the Package model.

Signed-off-by: Jan Blunck <jblunck@infradead.org>
[api] Don't check for source access Webui::PatchinfoController::require_exists

The patchinfo file is not considered source and therefore we shouldn't
check for source access permissions.

Signed-off-by: Jan Blunck <jblunck@infradead.org>