Refactored API VariantsController scope.

The Spree::API::VariantsController commits a few crimes:

1. Using .active in an attempt to get non-deleted variants, when active
has nothing to do with active, and instead determines if the Variant has
a price in the current currency.

2. Uses || for a permission check instead of &&

3. Explicitly tests a users role rather than testing permissions

4. Uses unless/else

5. Duplicates code

This refactored code should be easier to read, and more correct.

Fixes #4519
Drop windows.location.reload when editing tracking number
Fix issue where payments can get their credit cards disassociated from them.

This was initially discovered when integrating with the paper_trail gem, which
calls dup in an after_update to try to capture the changed state of the
object, however, this could happen elsewhere and it is good to be
defensive here.

Fixes #4512
Pass source attributes to force validation on spec
Fix order_details_spec when edit tracking
check show deleted when searching for deleted products
default show deleted to fault and carry it's state over

Fixes #4509
Account for 1.3 upgrade when warning about migrations

Fixes #4518
Sample should only create Store if none exists yet

There's a migration which already create a store record. Creating it
again on the samples breaks the spree install due to validation on
Store#code uniqueness
Remove unused spree_backend.js file leftover from asset migration.
Remove unused spree_backend.css file leftover from asset migration.