[APIv3] Specify status endpoint and edit form for WP

Specifies:
* [#17012](https://community.openproject.org/work_packages/17012)
* [#16971](https://community.openproject.org/work_packages/16971)

This PR introduces specification for:
* The full reading part of the statuses endpoint
* PATCH-ing the status of a work package
* edit forms to define which parts of a resource can be changed and which restrictions there are

To Do
-------

- [x] verify permissions needed to view statuses (currently "view work package anywhere")
- [x] Specify first set of action-links (will be required for forms)
- [x] Specify form endpoint
    - [x] basic structure
    - [x] abort errors (HTTP 4xx)
    - [x] indication of validation errors

Open Questions
---------------------
- [x] allowed values (links) vs. allowed values (non-links, e.g. strings)
    - values resource like `/foo?value=Cat`
- [x] handling of overly large lists of allowed values (e.g. users)
    - external collection resource (possibly paginated, possibly searchable)
- [x] what is the link of `changeParent`? Is it different from `update`?
    - same target, but answers question "can I change the parent"; answer can now be found in the form

Remarks
-----------

* This PR also defines behaviour for PATCH/POST calls with completely wrong request bodies (i.e. non JSON; e.g. XML)...
    * specified as HTTP 400
    * most endpoints answer with HTTP 500
    * star/unstar require empty request body
I first thought that I'd mark everything with "not implemented" and the one implementing it will remove that mark.

But:
1. I did not mark everything
2. this might not be the best idea either...

I'll remove the mark for now