Reimplement a fix preventing managers from locking themselves out of private projects

This improves the earlier implementation e08fc01af521334465e4cd356e8a55c8386960f7, now the logic is at the API level (project_update() function) instead of manage_proj_update.php), so Mantis behave consistently from GUI as well as SOAP.

Also adds SOAP test case, although it is not 100% useful since we can't do user management from the API.