Consider maintainer role when showing reviewers for review by_package

Right now we show all users that have a role assigned on a package,
no matter if the role empowers or requires the user to leave a review
or not. We only want to show the user that have a maintainer
role on the package. Also if the package has a maintainer
assigned we first want to show those and only default to the project
one's if they are missing.

Co-authored-by: Daniel Donisa <daniel.donisa@suse.com>