Add request state updating functionality to API

WIP

Adds a new `update_state` method to the API that uses the existing API key mechanism to send a status update to a request created via an external API request. Intended usage - foi-register end-users confirming whether the information they requested has been disclosed ([the parallel work on foi-register can be found here](https://github.com/mysociety/foi-register/tree/issues/169-ask-user-to-confirm-request-state)). Status description mismatches should be handled on the foi-register side but unexpected status values are rejected with a 500 error by the API.

Adds an optional parameter to the pre-existing `add_correspondence` API method to allow it to update status (intended use - updates from a public body) if a `state` value is supplied. Again, the foi-register code is responsible for handling state description mismatches but in this case the API deals with erroneous data by ignoring that part of the request.

Apologies for having restructured `api_controller_spec` but I kept losing track of which API methods the various tests were targeting. I will be happy to change it back before finalising the Pull Request if I've caused trouble.
Use `&&` instead of `and`.