Via the UI adding a mailinglist for CC works, but via
the API currently it shows:

One or more PHIDs were invalid for ccPHIDS

This removes the user validation check for ccPHIDs.

(I left it in for other things like owner since that seems
still appropriate?)

used arc locally to add a mailinglist to cc

echo '{"id": 2, "ccPHIDs": ["PHID-MLST-ohduchbv4dfimk7opt3r"]}' | arc call-conduit maniphest.update