Add endpoint: PUT /api/v1/user/shortlist/:course_id

This endpoint adds a course to the authenticated user's shortlist.

## Test plan

Ran `$.ajax('/api/v1/user/shortlist/cs444', { type: 'PUT' })` and checked response. Ensured multiple calls to this is idempotent.

Ran `$.ajax('/api/v1/user/shortlist/non-existent-course', { type: 'PUT' })`, ensured 400 response.