Set one answer's review status

Records a reviewer's verdict on a single answer — the write behind the Approve and Deny buttons on the review-per-company panel and on the responder's read-only view of an IN_REVIEW request. Only the company that sent the request may review its answers; the company that was asked cannot approve its own, and gets 403 cannot_update_response_status. An unknown request answers 404 request_not_found and an unknown question 404 question_not_found, in that order — so a call naming both an unknown question and someone else's request reports the question. APPROVED and DENIED are the two a button sends; IN_REVIEW and NOT_SUBMITTED are also accepted, for API-key clients that have been sending them. Two things are deliberately quiet: patching a question the supplier never answered updates no rows and still responds 204, and the write stamps no audit columns, so an answer's status carries no record of who last moved it — matching every row already on the table. Recomputing the questionnaire's and the request's answer statistics is handed to the message worker over AMQP. Responds 204 with an empty body.