[APIv3] Specify status endpoint and edit form for WP

Specifies:
* [#17012](https://community.openproject.org/work_packages/17012)
* [#16971](https://community.openproject.org/work_packages/16971)

This PR introduces specification for:
* The full reading part of the statuses endpoint
* PATCH-ing the status of a work package
* edit forms to define which parts of a resource can be changed and which restrictions there are

To Do
-------

- [x] verify permissions needed to view statuses (currently "view work package anywhere")
- [x] Specify first set of action-links (will be required for forms)
- [x] Specify form endpoint
    - [x] basic structure
    - [x] abort errors (HTTP 4xx)
    - [x] indication of validation errors

Open Questions
---------------------
- [x] allowed values (links) vs. allowed values (non-links, e.g. strings)
    - values resource like `/foo?value=Cat`
- [x] handling of overly large lists of allowed values (e.g. users)
    - external collection resource (possibly paginated, possibly searchable)
- [x] what is the link of `changeParent`? Is it different from `update`?
    - same target, but answers question "can I change the parent"; answer can now be found in the form

Remarks
-----------

* This PR also defines behaviour for PATCH/POST calls with completely wrong request bodies (i.e. non JSON; e.g. XML)...
    * specified as HTTP 400
    * most endpoints answer with HTTP 500
    * star/unstar require empty request body
We will (in the future) be using forms for more than only work-packages. This means that their documentation should be kept central, because the concept is always the same. However: The endpoint changes for each resource that is editable (`work_package/1/form`, `banana/42/form`, etc).

What you are reading here is the general explanation of forms, therefore I tried to use terms like "**a** form endpoint", to make clear that forms can be everywhere (usually "close" to their edited resource).

I could include an example: "a form endpoint (e.g. `/api/v3/work_packages/1/form`)", would that help?