[WIP] Stop viewers being able to create releases

A viewer can currently create a new release (which they shouldn't be able to do).

/cc @zendesk/samson
@steved555 @dasch I can't work out the scoping issue here. It doesn't seem to be able to access project.id from inside this block. Anything I'm doing wrong?