[WIP][#1471] Fix dataset deletion authorization for unowned datasets

We are basically deferring the whole package_delete auth function to
package_update, because deletions are basically changing the state field
of a dataset from 'active' to 'deleted'.