Optional CVV response

Currently Spree requires that a successful gateway response include a cvv_result.
But that breaks the bogus gateway which isnt sending a cvv_result 

This PR makes cvv_result optional. The specs were slightly refactored to reflect that a default success response is without cvv_result.