Ensure avs_response == 'M' is not considered risky

Addresses mistakenly considering an `avs_response` of `'M'` as risky as pointed out by @radar in https://github.com/spree/spree/pull/4021