Uploads of new packages should go to 'candidates' by default

This was suggested as a change to cabal-install by @hvr but we can just change hackage-server itself to not allocate new public namespace unless a package is promoted from candidate.

This should encourage the use of the candidates feature, and more importantly vitiate against the accidental upload of internal stuff to the public hackage instance.