[6.x] Forms 2: Spam submissions

[duncanmcclean]

This pull request adds the concept of spam form submissions.

A submission can be flagged with spam: true and it'll be reported and displayed as spam, hidden from the submissions listing, and excluded from submission counts and submission limits.

Honeypot behavior

Forms have a new "Honeypot Behavior" setting on the configuration screen, controlling what happens to submissions caught by the honeypot:

• Ignore (default): the submission is silently discarded, matching the previous behavior.
• Save as Spam: the submission is stored and marked as spam, without triggering emails or connections.

Either way, the visitor receives the same response as a successful submission, so bots can't tell they've been caught.

Marking submissions as spam / not spam

This PR also adds "Mark as Spam" and "Mark as Not Spam" actions to the submissions listing.

When a submission that was caught before being finalized is marked as not spam, it gets finalized as normal — triggering any configured emails and connections at that point. Submissions that were manually flagged after being finalized simply have the flag removed, so nothing is re-triggered.

Marking submissions as spam from addons

The honeypot is the first thing to take advantage of the spam status, but addon developers can also mark submissions as spam inside event listeners if they wish:

Event::listen(function (FormSubmitted $event) {
    if (Akismet::isSpam($event->submission)) {
        $event->submission->markAsSpam()->save();

        return false;
    }
});

Returning false halts the submission pipeline while still giving the visitor a successful response. Since the submission was saved as spam beforehand, it'll be waiting in the submissions listing for review.