Handle denied authorization

[AlexP11223]

Fixes #302 and #312. Also some other bugs like missing metadata on captured orders paid via saved card (making impossible to refund).

There was lots of mess in the payment handling, duplicated code in different places (sometimes missing some things), etc. I tried to improve it a bit by extracting some things to traits.

The order state/messages should now match the behavior suggested by @Chaithi.

The only thing that I am not sure is when we have intent=CAPTURE and get a capture with FAILED status, maybe we need to make order failed and show some error? I am not sure when such status can occur.

Also we now always add an order note with the status and status details when we get a capture/authorization with details. As I understand besides PENDING we may get details for declined payments.

For #312 it is more like a quick fix.
As I mentioned it #305

The logic in this part is a bit complex because theoretically it is possible that there are multiple authorizations. I don't know if it is actually possible, but that's how it was handled before.

We should figure out if it is actually possible to have multiple authorizations here, and decide how we need to handle them, or (if only single authorization is possible) simplify this part.

For now the order state is decided using the capture of the last captureable authorization in the list.