Deleting applications

[opqdonut]

Example use cases:

• deleting all applications older than n years due to GDPR etc
• deleting a single application that contains sensitive data or
  illegal content
• deleting all applications for a user after a GDPR request

Plan:

• allow /api/applications/delete (a command that deletes a single application) for all applications
  • only to owner, or perhaps to a new separate role (system?)
• add deletion of application to end of end-to-end test
• create example python script that fetches all applications via the API and deletes all that are over x days old
  • or perhaps all that relate to a certain applicant
• config option to enable deletion (disabled by default)
• soft delete first (deleted_at column in tables)
• background "poller" job to delete for real (default: after 90 days)
• configurable retention policy

[Macroz]

Some of the logic is ready thanks to #2665, #2729 and #2906.