Blacklist manifest.json & milestones user (#10292)

Fix #10290

models/user.go

@@ -855,7 +855,9 @@ var (
 		"issues",
 		"js",
 		"less",
+		"manifest.json",
 		"metrics",
+		"milestones",
 		"new",
 		"notifications",
 		"org",