Set approver of aliases/implications in BURs.

Previously only the BUR's approver was set when a BUR was approved. Set
the approver for each alias/implication in the BUR as well.

Additionally:

* Refactor `approve!` to take a user instead of just a user id.
* Be mass-assignment permissions aware when setting approver_id.

app/controllers/bulk_update_requests_controller.rb

@@ -31,7 +31,7 @@ class BulkUpdateRequestsController < ApplicationController
   end
 
   def approve
-    @bulk_update_request.approve!(CurrentUser.user.id)
+    @bulk_update_request.approve!(CurrentUser.user)
     respond_with(@bulk_update_request, :location => bulk_update_requests_path)
   end