HTTP Patch makes direct update_attributes call on Spree::Order

Potential solution to this issue:

https://github.com/spree/spree/issues/5543

This PR allows the API Orders endpoint to PATCH an order and just update the attributes, without going through OrderContents update_cart. This will fix the scenario where we want to update a simple field in the Spree::Order, like email or a decorated gift_message in the middle of checkout.

As is, any change PUT #update will reset the entire checkout flow.  By providing PATCH, we're letting API clients make these simple field changes without causing checkout to get recycled.