Remove unnecessary validation

I cannot think of a single scenario under which we ever create an
edition in a "published" state, so getting rid of the validation. Also
simplifying the validation on drafting an edition.
Remove unused method
Clean up state machine and access controls

Removing unnecessary methods and relying more on the state machine for
truth with regard to whether the edition can have certain actions
performed on it.
Move related methods together

It doesn't make sense for the reject/approve-related methods to be
apart from the rest of the publishing-related methods
Remove unnecessary mixin

Having these methods in a module that is mixed in has no discernible
advantage, and makes things harder for developers.
Prise apart publish and force publish

They will be two distinct service operations so it makes sense for
them to be distinct actions as well.
Rely on Whitehall::Authority for access limiting

Step one of removing all authorisation-related code from the Edition
model. Thanks to @hlame's steller work, all the logic for access
limiting editions already exists in the enforcement rules within
Whitehall::Autthority and are also thoroughly tested, so this was a
relatively straightforward process. The access limiting method on
Attachment was also factored out for completeness.
Unstub EditionsWorkflowControlllerTest

These tests were heavily stubbed and so tightly coupled to the
implementation, rendering them useless once the implementation
changed. I've unstubbed them as best I can for now, effectively
turning them into mini-integration tests so we can be sure that no
behaviour has broken. Once we have service objects to handle the
complex logic for each workflow action, these tests will be
simplified down to basics, as the bulk of the logic will live outside
of the controller. Hence I haven't really made an effort to improve
these tests as they will be completely re-written soon.
Remove unused options
Edition#approvable_by? is a red herring

It's materially the same as Edition#publishable_by? and is never
called outside of tests
WIP Rely on Whitehall::Authority for publishing perms

As with access limiting, the rules that govern whether a user can
publish or force publish an edition are (mostly) present and correct
in Whitehall::Authority. This removes any knowledge of the users
publishing permissions from the Edition model as we can rely on the
controller to guard based on permissions.

The one exception was the permission on publishing a scheduled
edition. This is what guards that only the scheduled publishing robot
can publish scheduled editions. I've updated the EditionRules to
reflect this.

NOTE: There is work remaining here and that is to prise apart
publishing and force publishing so that they are separate transitions
rather than force publishing being an option that is passed to the
publish_as method. This is so that we can have separate
Edition#can_publish? and  Edition#can_force_publish? to verify that
the edition is in an appropriate state to perform the action
Rely on Whitehall::Authority for reject perms

It's getting easier...
Rely on Whitehall::Authority for unschedule perms

Another straightforward one
Untangling combined publish/force publish method

This prises apart publishing and force publishing so that they are
performed with two distinct methods and have separate state machine
transitions and validity checks. This removes the need for the :force
flag when publishing and also makes it easier to define the valid
transition state for either case. This manifests itself in
editions#show, where we can now ask both a) if the user has permission
to perform the publishing action and b) if the action can be performed
on the edition.

I've tried not to change the tests too much with this commit to both
make the review easier and also to guard against regressions; the
tests around publishing and force publishing are a bit of a mess and
spread all over the place, but it makes more sense to tidy these up
once the workflow action service objects are extracted.