[api] Refactor AnonymousUser exception into ForbidsAnonymousUsers module

This is a prerequisite to checking for anonymous user (be_not_nobody!) in
other places, e.g. the Package model.

Signed-off-by: Jan Blunck <jblunck@infradead.org>