Fix internal server errors on requests with unexpected parameters

[richardebeling]

We had some views where users could trigger server errors if they wanted. Fix them so they result in 400 - Bad Requests, as they should.

For the views that can only be accessed by trusted users (managers, reviewers), it makes sense to keep the logging, as we would assume that the request was triggered by our code and we might want to investigate. A SuspiciousOperation will be logged at Error level, which we should be informed about.

[richardebeling]

Refactored a bit:

• Django introduced a BadRequest exception in 3.2. We can use that to return a 400 that shouldn't be logged at error level.
• I noticed we already use SuspiciousOperations at a few places where requests have missing/wrong arguments. I think it's a fair solution, as it will also result in 400 and the request will be logged.

I'll add tests later.

Regarding #1721 (comment) and #1721 (comment), I'd say we should stick to the intended meanings of 400 and 404, as it will make debugging easier (so no 404 for a parameter that's missing or of the wrong type)

[richardebeling]

I added tests in a new commit, so you may want to review by commit. It's a rather big pile of code for the tests, partly because most of the views were completely untested before. On the bright side, these tests cover 8 views from #1630. Coverage increases by 0.5%.

[niklasmohrin]

Haven't looked at tests yet, rest looks good