Authorize move_path

Additionally turn the after_action around and maintain a whitelist instead of a blacklist. This requires new methods authorized by default.

new_package and it's dialog are just informal authorizations, so people do not even try to do this.

Co-authored-by: Henne Vogelsang <hvogel@opensuse.org>