Consider user roles when showing reviewers for review by_package

Right now we show all users that have a role assigned on a package,
no matter if the role empowers or requires the user to leave a review
or not. We only want to show user that have a reviewer or maintainer
role on the package. Also if the package has a maintainer or reviewer
assigned we first want to show those and only default to the project
one's if they are missing.