[api] Don't check for source access Webui::PatchinfoController::require_exists

The patchinfo file is not considered source and therefore we shouldn't
check for source access permissions.

Signed-off-by: Jan Blunck <jblunck@infradead.org>
[api] Use be_not_nobody! in Package model

If the source access is disabled for a package or project we want the user
to login. Therefore lets add a check for authentication before we check for
permission.

Signed-off-by: Jan Blunck <jblunck@infradead.org>