Simplify Package/Project source_access policy

Less layers of indirection (can_source_access -> can -> has_local_permission)
and less duplication (has_local_permission already checks the Project of a Package)