[api] can_be_modified_by? method for Package and Project model

This commit adds a can_be_modified_by? method to Package and Project model, which
checks if a user has direct access rights for a package / project.

This allows us to simplify some code, since we don't have to check what
object we are working with.