Hide rejected objects if never approved.

The old behaviour is that rejected objects will always be displayed in
querysets, which is weird.

In my view, if an object has never been approved, it should be hidden. If
it has been approved, but a change to it is rejected, then the change should
be reverted and the object should continue to be visible, as it was when it
was approved.

This patch implements that behaviour by using the undocumented
moderation_state column to put objects that have never been approved into
DRAFT state, which hides them from the public but allows the admin to see
them. Once an object has been approved once, its state becomes READY, and
rejections don't change it back to DRAFT, they simply undo the changes.

Note that this changes the behaviour of the moderation_state field slightly.
In particular, the admin will be invited to moderate objects in DRAFT state,
which previously they were not.