BURs: allow only pending BURs to be rejected.

Fix it being possible to reject approved BURs, or to re-reject already
rejected BURs.

Rejecting an approved BUR wouldn't revert the aliases/implications, but
it would change the BUR's status to rejected.

app/models/bulk_update_request.rb

@@ -181,6 +181,14 @@ class BulkUpdateRequest < ApplicationRecord
     user_id == user.id || user.is_builder?
   end
 
+  def approvable?(user)
+    !is_approved? && user.is_admin?
+  end
+
+  def rejectable?(user)
+    is_pending? && editable?(user)
+  end
+
   def reason_with_link
     "[bur:#{id}]\n\nReason: #{reason}"
   end