[APIv3] Specify status endpoint and edit form for WP

Specifies:
* [#17012](https://community.openproject.org/work_packages/17012)
* [#16971](https://community.openproject.org/work_packages/16971)

This PR introduces specification for:
* The full reading part of the statuses endpoint
* PATCH-ing the status of a work package
* edit forms to define which parts of a resource can be changed and which restrictions there are

To Do
-------

- [x] verify permissions needed to view statuses (currently "view work package anywhere")
- [x] Specify first set of action-links (will be required for forms)
- [x] Specify form endpoint
    - [x] basic structure
    - [x] abort errors (HTTP 4xx)
    - [x] indication of validation errors

Open Questions
---------------------
- [x] allowed values (links) vs. allowed values (non-links, e.g. strings)
    - values resource like `/foo?value=Cat`
- [x] handling of overly large lists of allowed values (e.g. users)
    - external collection resource (possibly paginated, possibly searchable)
- [x] what is the link of `changeParent`? Is it different from `update`?
    - same target, but answers question "can I change the parent"; answer can now be found in the form

Remarks
-----------

* This PR also defines behaviour for PATCH/POST calls with completely wrong request bodies (i.e. non JSON; e.g. XML)...
    * specified as HTTP 400
    * most endpoints answer with HTTP 500
    * star/unstar require empty request body
I wanted to start to link to [the purpose](https://github.com/opf/openproject/blob/2839c3f8c04a0f1838db88337506ac7b9f744e06/doc/apiv3-documentation.apib#L534-L539), but I am happy to ignore this part of the question ^^

In general: We want to indicate if the client did something wrong, i.e. that does not validate.
I see two approaches here:

* embedding those errors in the form (like proposed)
* send out a non-OK answer (e.g. HTTP 422)
    * In this case the client would receive the errors without a wrapping form

However this raises the question: How do you indicate which values are allowed in a hypothetical resource state.
Think of a resource with `A = 1, B = 2` allowed values for B are:
````
1, 2, 3 if A = 1
3, 4, 5 if A > 1
````

If you now set `A = 2`, then `B = 2` is not valid anymore: `urn:openproject-org:api:v3:errors:PropertyValueNotAvailableAnymore`

If the client now only receives an error object and no form that contains the link to the newly available values for `B`, the client will not be able to recover.

**Another perspective** could be the following:
If you always send the form back the client does not have to care about too much state, because the state is encoded in the form. If the client would receive a bunch of errors instead of a form, the client would have to go back to the last *good* form it received and try again from that point on. So instead of going forward (always continue with the next state of the form), the client is forced to go back and forth on each error.

Is this the answer you were looking for or am I still missing the question? (I am not sure ^^)