[api] move request state change permission check to model
[api] split up global request permission handling
[backend] add --republish-repository option to obs_admin
[backend] improve error message on key removal
[api] move request permission check code to right class