Don't allow review of storage requests that were not submitted

[mzur]

The storage request controller shows only requests that were not approved yet but it does not hide requests that were not submitted. Requests that were not submitted should not be shown by the controller. Fix this and add an appropriate test case.

[mzur]

The tests are here. It also includes an example for a 404 response when the storage request was already reviewed. The same should be expected for a storage request that was not submitted.

[lehecht]

@mzur
Where are the unsubmitted storage requests displayed?

[mzur]

Admins/reviewers can see the storage requests. Usually they only click on the URL in a helpdesk notification but if they modify the ID in the URL they can see unsubmitted storage requests, too. These could be "approved" even though they are not finished yet. That should not be possible.