[obs_mirror_project] add api-url to osc meta calls

Add api-url to the osc meta calls for prj and prjconf to make sure the openSUSE api is used.
If the openSUSE API is not the default one prj and prjconf are just empty created or overwritten with nothing.
[api] allow to accept reviews for delete requests

wrote a test case to highlight issue #550 and fix it with yet another
attack of the spaghetti code monster
[api] refactor the whole changestate permission check

This whole logic if a request can change state is worth an extra file, it's
almost 300 lines of code