Remove unnecessary validation

I cannot think of a single scenario under which we ever create an
edition in a "published" state, so getting rid of the validation. Also
simplifying the validation on drafting an edition.
Remove unused method
Clean up state machine and access controls

Removing unnecessary methods and relying more on the state machine for
truth with regard to whether the edition can have certain actions
performed on it.
Move related methods together

It doesn't make sense for the reject/approve-related methods to be
apart from the rest of the publishing-related methods
Remove unnecessary mixin

Having these methods in a module that is mixed in has no discernible
advantage, and makes things harder for developers.
Prise apart publish and force publish

They will be two distinct service operations so it makes sense for
them to be distinct actions as well.
Rely on Whitehall::Authority for access limiting

Step one of removing all authorisation-related code from the Edition
model. Thanks to @hlame's steller work, all the logic for access
limiting editions already exists in the enforcement rules within
Whitehall::Autthority and are also thoroughly tested, so this was a
relatively straightforward process. The access limiting method on
Attachment was also factored out for completeness.
Unstub EditionsWorkflowControlllerTest

These tests were heavily stubbed and so tightly coupled to the
implementation, rendering them useless once the implementation
changed. I've unstubbed them as best I can for now, effectively
turning them into mini-integration tests so we can be sure that no
behaviour has broken. Once we have service objects to handle the
complex logic for each workflow action, these tests will be
simplified down to basics, as the bulk of the logic will live outside
of the controller. Hence I haven't really made an effort to improve
these tests as they will be completely re-written soon.
Remove unused options
Edition#approvable_by? is a red herring

It's materially the same as Edition#publishable_by? and is never
called outside of tests
WIP Rely on Whitehall::Authority for publishing perms

As with access limiting, the rules that govern whether a user can
publish or force publish an edition are (mostly) present and correct
in Whitehall::Authority. This removes any knowledge of the users
publishing permissions from the Edition model as we can rely on the
controller to guard based on permissions.

The one exception was the permission on publishing a scheduled
edition. This is what guards that only the scheduled publishing robot
can publish scheduled editions. I've updated the EditionRules to
reflect this.

NOTE: There is work remaining here and that is to prise apart
publishing and force publishing so that they are separate transitions
rather than force publishing being an option that is passed to the
publish_as method. This is so that we can have separate
Edition#can_publish? and  Edition#can_force_publish? to verify that
the edition is in an appropriate state to perform the action
Rely on Whitehall::Authority for reject perms

It's getting easier...
Rely on Whitehall::Authority for unschedule perms

Another straightforward one
Untangling combined publish/force publish method

This prises apart publishing and force publishing so that they are
performed with two distinct methods and have separate state machine
transitions and validity checks. This removes the need for the :force
flag when publishing and also makes it easier to define the valid
transition state for either case. This manifests itself in
editions#show, where we can now ask both a) if the user has permission
to perform the publishing action and b) if the action can be performed
on the edition.

I've tried not to change the tests too much with this commit to both
make the review easier and also to guard against regressions; the
tests around publishing and force publishing are a bit of a mess and
spread all over the place, but it makes more sense to tidy these up
once the workflow action service objects are extracted.
Untangling scheduling/force scheduling from user

As with publishing, this separates out the methods for scheduling and
force publishing. In doing so, it introduces some duplication, but
this is acceptable given the improved clarity and ability to pull
things apart when we move on to extracting the workflow service
objects.

It also introduces some new predicate methods for checking if a given
action can be performed on an edition. Up to now, we've relied solely
on the state-machine provided `is_TRANSITIONABLE?` methods to do this,
but now we need more sophisticated checks than just if the transition
is valid so we can determine if the workflow buttons should be
displayed to the use. This does introduce a bit of a weird overlap
between the `schedulable?` predicate check and the
`reason_to_prevent_scheduling` methods as they both perform slightly
different functions: the former determines if the action can be
attempted by the user; whilst the later does a more thorough check and
returns a reason for preventing the action from being performed. I'm
confident that this weird overlap can be ironed out when extracting
the service objects and think we can live with this weirdness for now.

Not that unlike for publishing where I extracted separate actions for
publishing and force publishing, I've not done so here for scheduling
and force scheduling as, unlike for publishig, there is very little
difference between the two actions. It may be that they need
separating out when we move to service objects, but that decision can
be deferred until then.
Rewrite unless/else
Rely on Whitehall::Authority for unpublishing

As for the other actions, this removes the coupling of user
permissions from the unpublishing method on Edition. I've rearranged
and re-written some of the unit tests for unpublishing for clarity,
but on the whole I've left the unpublishing code as is, despite the
fact that the way unpublishing hangs togother could do with some
further refactoring.
Rely on Whitehall::Authority for approval perms

Once again, remove the dependency on user, this time when approving
editions retrospectively. I've had to extend the enforcement rules
slightly here, as they did not account for force scheduled editions.
Simplify logic for preventing publication

the reason_to_prevent_approval method is now only used in one place
and makes things less readable.
Fix typo