Rework ReturnAuthorization-InventoryUnit relationship

* Create a join table: `ReturnAuthorizationInventoryUnit`
  * Allows inventory units to be part of multiple RMAs (e.g., if an initial RMA was cancelled) while still retaining historical data
  * Migrate existing data into the new table
  * Drop the `inventory_units.return_authorization_id` column
* Start using nested attributes for adding/removing InventoryUnits to ReturnAuthorizations
  * Remove the `API::ReturnAuthorizationsController#add` endpoint (use nested attributes instead)
* Pave the way for exchanges with an `exchange_variant_id` field
* Update the admin interface for `Admin::ReturnAuthorizationsController`:
  * No longer group inventory units by variant.  This will be important for allowing per-unit data, such as for exchanges

Created by @richardnuno and @jordan-brough

Fixes #4907
Fix failing payment spec.