Avoids sending around user passwords in exception mails.

Exception notifier would've picked this up. There are other request
parts (like raw_post_data) containing the password but these seem to be
stripped by exception_notifier itself.

[api] do not allow to "addreview" or "changereviewstate" in a request, which is not in "review" anymore

[backend] fix and test listing of repositories and architectures on remote projects in backend. needed by the webui.

[api] fix project branch call: do not break when a package gets found directly and indirectly via attribute search. (#673564)