Fix #update bug in DocumentMetadataDecorator

The extra attributes hash was completely replaced
on update with whatever was in the given hash.

This required the caller to provide all the
key/value pairs for the extra attributes or have
them wiped out. This was inconsistent with the
update behaviour of the other fields.
Merge pull request #175 from alphagov/fix-document-metadata-decorator

Fix #update bug in DocumentMetadataDecorator
Bump gds-sso to 9.3.0

Signon will start rejecting requests that don't include client_id in the
Near Future. Upgrading to 9.3.0 makes this app compatible before that
change happens.

This version of gds-sso has a dependency on multi_json 1.10.0, so bump
that too.
Merge pull request #176 from alphagov/bump-gds-sso

Bump gds-sso to 9.3.0