add submitted/unsubmitted quiz users endpoint to quizzes api

Test plan:
  - As a teacher, create a quiz.
  - Visit the quizzes API using JSONAPI headers. For that quiz,
    "submitted_students" should be null. You should get a URL back to
    the "unsubmitted_students" endpoint, which you can query and find
    the unsubmitted students.
  - As a student submit the quiz. As a different student, don't submit
    the quiz.
  - As a teacher, visit the quiz show endpoint for that quiz again. You
    should have "submitted_students" and "unsubmitted_students" under
    the "links" hash. Query these APIs using those URLs. The students
    returned from the link that looks like "?submitted=true"
  - As a student, you should not see "submitted_students" or
   "unsubmitted_students" under the "links" hash when querying
   the show API in JSONAPI format
  - In non-jsonapi format as any user, you should not see
   "unsubmitted_students" or "submitted_students"

closes CNVS-11687

Change-Id: I7094dfc37b0dde501e5a2c1f12ade983cd2a150a
Reviewed-on: https://gerrit.instructure.com/31223
Reviewed-by: Derek DeVries <ddevries@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>
Product-Review: Stanley Stuart <stanley@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>