Bug: Only allow users to create their own project user records

[begedin]

From #1232,

A user can create their own ProjectUser record - no role level check happens here, so this is definitely a bug. Basically, accessing the API directly, any user can make themselves owner, collaborator, admin or pending member of a project

To fix this, we should enforce the following create rule

A user can create their own ProjectUser record, provided the role is "pending". This basically means they are allowed to apply for project memberships