[api] Attempt authorization for an order if an order token is passed

This stops the 'You must specify an API key' error message from (incorrectly) appearing. That message is now supressed if an order token is passed in.

When an order token is passed, the authorize_for_order filter is called, which attempts to find an order and then compares the order's token with the order token from params/headers

Conflicts:
	api/app/controllers/spree/api/base_controller.rb
Test order authentication.

This code was previously untested.

Fixes #4440
Authorize an order through cancan.

Fixes #4440
Touch an order when a line item is saved

Fixes #4419
backend: Remove missing reports#show route

Fixes #4528
Fix issue where payments can get their credit cards disassociated from them.

This was initially discovered when integrating with the paper_trail gem, which
calls dup in an after_update to try to capture the changed state of the
object, however, this could happen elsewhere and it is good to be
defensive here.

Fixes #4525
More robust namespace adjusting

As discussed in https://github.com/spree/spree/issues/4479, the existing migration would generate inaccurate class names due to the fact that `demodularize` will only select the very last part of the class name.

So, for instance,

`Spree::Calculator::Fedex::Ground` would be changed to
`Spree::Calculator::Shipping::Ground`, which would trigger an `uninitialized constant` exception. The desired new class name is
`Spree::Calculator::Shipping::Fedex::Ground`, and this suggested PR will handle those class name changes more appropriately.

Fixes #4520
Adding data-hooks to admin shipping method form

Our app does some rearranging of these elements, and it's dramatically easier if not only the group of fields, but the fields themselves have `data-hook` defined. This should help anyone working with this group of fields in Deface.

Fixes #4521