Canonical URL changes should be possible for all packages with a review queue

Currently we block updates after a certain amount of downloads, this generates manual work on the support side and it's a pain to validate people are the actual maintainers.

It'd be better if they could do the URL update but instead of blocking we'd block it but tell them it's pending, and put the update in an admin review queue, and then notify other maintainers (if any) on the package of the update request (so they can reject it or approve it), as well as notify admins.

2FA state should be tracked at the time of the request creation to highlight whether the account is on the more secure side or not.

Could also eventually be an organization policy that any edits has to be approved by at least x org members.

Probably could be implemented with the symfony workflow component to keep things moving in a clear flow.