Allow setting a review request's status with just the can_change_status permission.
The review request API didn't allow changing a review request's status

by users other than the submitter when they had the 'can_change_status'

permission, unless they also had the 'can_edit_reviewrequest'

permission. 'can_edit_reviewrequest' should not have been required.
The API is now more careful about when it returns a 403, based on the

permissions and the data provided in the request.

Unit tests pass, which didn't prior to the change.