[backend] projectsourceinfo: allow empty package list for remote projects
[api] support product versions also for updates
[ci] validate not matching searches

(to validate bugreport)
[api] fix product version searches
[api] Refactor AnonymousUser exception into ForbidsAnonymousUsers module

This is a prerequisite to checking for anonymous user (be_not_nobody!) in
other places, e.g. the Package model.

Signed-off-by: Jan Blunck <jblunck@infradead.org>
[api] Use be_not_nobody! in Package model

If the source access is disabled for a package or project we want the user
to login. Therefore lets add a check for authentication before we check for
permission.

Signed-off-by: Jan Blunck <jblunck@infradead.org>