Add decrypt PDF API endpoint, add decryption to approve process

[stefanw]

• PDF decryption got some utils and an API action on attachment (tests included)
• I removed the canPublish on pdf-redaction:
  • We don't have a concept of "publish" on attachment, only of approval. Publishing happens on the foirequest level.
  • Instead we should replace or remove redacted versions on redaction or approval, respectively.
• The approval view (non-API) now does decryption on PDFs when a password is provided. This means no-redaction encrypted PDFs don't need to go through the redaction process anymore.