Add API endpoints for seen_by

[eloquence]

As part of adding SecureDrop Client support for highlighting sources with unseen submissions (freedomofpress/securedrop-client#187), we need to make server-side changes to record which journalist has seen a message, file, or reply. This breaks down into two main tasks:

• issue Migrate messages, files, and replies to seen_by architecture #5474: migrating the existing downloaded status and business logic to seen_by (for messages, files, and replies);

• this issue: adding API endpoints for updating and retrieving seen_by status

Technical specification

A working draft specification can be found here:
https://docs.google.com/document/d/1szPEKI1gTpRiM_YI87plKgiW39T7zT4Y4HG0uFnsJD4/edit#

Functional requirements

Setting status via API: As an API user, I should be able to set the seen_by status for a file, message, or reply to the authenticated user.

Retrieving status via API: As an API user, I should be able to retrieve the seen_by status for any message, file or reply.

Performance requirements

We want to keep API consumers like the SecureDrop Client responsive with a large number of sources and submissions per source:

https://github.com/freedomofpress/securedrop-client/wiki/Scalability-&-Performance#scalability-requirements

Our performance goals may impact decisions such as how many API roundtrips are required to update or retrieve information, how much data is returned, and what operations can be grouped together. As part of this issue, we should aim to obtain before/after benchmarks e.g. of metadata sync operations for a server with a large number of submissions, so we can quantify the performance impact.

[eloquence]

(Removed from the board because #5513, which is tracked on our current sprint, is expected to fully resolve this issue as specified.)