Ensure correct access to all manifests + introduce "public" package manifests

[kjac]

Prerequisites

• I have added steps to test this contribution in the description below

Description

Currently the editor needs access to the packages section in order to load package manifests. This won't do, because everyone with access to the backoffice potentially has to load package manifests.

Also, we need publicly available manifests, i.e. manifests that are allowed to load without backoffice access. These are necessary to power customizations of the login screen. It must be an explicit opt-in to be a "public" manifest.

Example of a manifest with public access:

{
    "name": "My Public Package #1",
    "version": "1.0.0",
    "allowPublicAccess": true,
    "extensions": [{
        "alias": "My.Whatever",
            "name": "My Whatever"
        }
    ]
}

Testing this PR

1. The "all package manifests" endpoint should be available for users without access to packages, settings or the like. That is, a "simple" content editor with only content access should still be able to load the manifests.
2. The new "public manifests" endpoint should be available without authentication.

[iOvergaard]

LGTM