Add option to forbid source and/or binary uploads to a suite

This is intended to be used to forbid uploads to policy queues and build
queues which would result in confusing results.  While we already have a
"reject" option in the dak.conf's SuiteMappings, having the option in
the database means we don't have to edit dak.conf when configuring new
suites.

Another usecase will be the "unstable" suite for Debian Ports: here we
want to import the source packages (and arch:all) from the main archive
and only accept binary uploads.  Additional source packages must go into
the "unreleased-*" suites.  This was not possible via SuiteMappings.

Bug: https://bugs.debian.org/783115