Quiz Submission Questions API - Update

This patch provides support for answering Quiz Questions via the API.

closes CNVS-9844, CNVS-10225

TEST PLAN
---- ----

Testing this will be a bit rough because there are many variations and
validations to cover. I'll spare the validations that are covered by
specs from the test plan.

Create a quiz with a question of *each* type except "Text" and "File
Upload". There's a script that creates a quiz with its questions
automatically for you if you don't want to keep doing this manually. See
references.

> Answering Questions

Now you need to answer each question via the API. Most of them vary in
formats, but they are fully specified in the API documentation page
(along with examples). See DOCUMENTATION for more info.

> Flagging Questions

Flagging, and unflagging, a question is the same regardless of its type,
see the "EXAMPLE REQUESTS" section.

> Access Validations

Here are some generic, non-question based validations to verify. You
should NOT be able to answer a question if:

  - the quiz submission has been turned in
  - the quiz submission is overdue
  - the Access Code for the quiz is invalid
  - the IP filter of the Quiz prohibits you from taking the quiz
  - the quiz submission :validation_token is incorrectly specified (ie,
    other students shouldn't be able to answer your questions)
  - you don't specify the latest :attempt, so if the Quiz has multiple
    attempts, and this is your 2nd take, you specify an :attempt of 1,
    3, or anything but 2 should fail
  - NEW: turn quiz into an OQAAT quiz with the "Can't go back" flag on;
    the API should not reject all requests to modify any of the
    questions with a 501 error saying that type of quizzes is not
    supported yet (support will come in CNVS-10224)

> Grading

Also, when you're done answering the questions, take a look at the
grades and make sure everything gets graded just like it does when using
the UI directly.

> Verifying results in the browser

While taking a quiz in the canvas UI, the scripts perform backups in the
background that would overwrite any changes you do via the API. If you
want to verify the changes you make via the API from the UI, you must
append "?backup=false" to the take quiz page URL, something like this:

http://localhost:3000/courses/1/quizzes/1/take?backup=false

Setting that flag will (for now) disable the backup behaviour and should
make things tick.

EXAMPLE REQUESTS
------- --------

Don't forget to set the 'Content-Type' header to 'application/json'!

> Answering a Multiple-Choice question

[PUT] /api/v1/quiz_submissions/:quiz_submission_id/questions/:id

{
  "attempt": 1,
  "validation_token": "1babd0...",
  "answer": 10
}

> Flagging a question

[PUT] /api/v1/quiz_submissions/:quiz_submission_id/questions/:id/flag

{
  "attempt": 1,
  "validation_token": "1babd0..."
}

> Unflagging a question

[PUT] /api/v1/quiz_submissions/:quiz_submission_id/questions/:id/unflag

{
  "attempt": 1,
  "validation_token": "1babd0..."
}

DOCUMENTATION
-------------

Run `bundle exec rake doc:api` and check out the Quiz Submission
Questions page. There's an Appendix that contains example requests for
each question type, as well as the errors produced by each handler.

LINKS
-----

  - bootstrap script:
    https://gist.github.com/amireh/e7e8f835ffbf1d053e4c
  - direct link to the API documentation page:
    http://canvas.docs.kodoware.com/quiz_submission_questions.html

Change-Id: I9a958323ece8854bc21a24c2affd8dc3972e46d5
Reviewed-on: https://gerrit.instructure.com/27206
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Derek DeVries <ddevries@instructure.com>
QA-Review: Myller de Araujo <myller@instructure.com>
Product-Review: Ahmad Amireh <ahmad@instructure.com>