credit card spec fix

fixes #4778
fix for payments made via /admin

orders placed via /admin were being charged twice.

See these two lines from Spree::Admin::PaymentsController:

    while @order.next; end
    @payment.process! if @order.completed?

For incomplete orders the first line will trigger callbacks that cause
the payment to be charged if the order reaches the "completed" state.
Then the second line will process the payment *again*, resulting in a
double charge.

We can't just remove the second line because orders that are already
complete won't trigger any callbacks from the first line, so these
orders need to have their payments charged manually.

The effect of the bug in our case was that Braintree rejected the second
(duplicate) billing on the payment, and this resulted in the Payment
object being marked as failed when actually it succeeded on the first
attempt. So it appeared from within Spree that a successful payment
was a failed payment.

Fixes #4768
Add explicit spec for double payment processing issue
The result call is checked earlier

It does nothing inside this function. and its all private. so I can
change what I want.

Fixes #4782
check_authorization should use params token first

in check_authorization method.
The original code is:
session[:access_token] ||= params[:token]

So once session[:access_token] has been set, I can't reset it unless I close my browser to invalidate session.

The example scenario is below.

If I had a order url with token "http://www.example.com/orders/R176458284/token/383caf1a6dd71df4"
However, I incorrectly copy and paste it to browser and open it:
"http://www.example.com/orders/R176458284/token/383caf1a6dd71"
Now I got a unauthorized 401 page, that's correct because my token is wrong.
But after that, I try the correct link again and it still won't work since session[:access_token] has already been set and won't be set again even I pass a new params[:token]

I believe the correct logic is to check params[:token] first, once params[:token] is available, session[:access_token] should always be overridden by params[:token].

Thanks.

Fixes #4791
Add spec for overriding order token
Fix failing api spec

ids aren't guaranteed to be returned in the same order, so change eq to
match_array.

Fix #4796
Welcome scope Promotion#coupons

It makes sense sometimes to only fetch promotions where a coupon code is
present
Better errors on coupon code failing

Assuming everything that wouldn't activate properly was "already
applied" doesn't work since anything that fails to activate but wasn't
"already applied" shows up to an end-user as "already applied". By
explicitly checking for coupons already applied we can put a more
generic error if activate fails.

Fixes #4781
Refactor stock transfers variant select JS - Allow user to search for a variant by name or SKU, rather than just returning the first 25 items from a stock location

Closes #4795
update the default email template to include all the proper taxes, shipments and adjustments

Fixes #4798
Update payment risk assessment, and fix broken specs. Fixes #4630