Add support for organizations

As an organization manager, I would like to be able to control who can access my packages so I can give access to new employees and also remove leavers.

At the moment this has to be done package by package, which can get burdensome if your number of packages grows.

Ideally, there should be something like "organizations" where organizations admins can manage users belonging to the org. Similar to what GitHub, NPM, etc.. offer.

This would also be a great way to control vendor namespace ownership. The current approach of "if you are in a single repo, you have access to the whole namespace" is a bit flaky. What if you have an external contributing to a single package?

Something like SSO would be just awesome, but I consider that more of a paid enterprise feature.

The issue does not name files, tests, or an entry point. Start by mapping the existing package-by-package access and namespace ownership flows, then define organization membership and administrator behavior; done would mean organization admins can add or remove users and manage package access without relying on single-repository membership.

Written by the indexing model from the issue text.