PUT /cve-id/:id should throw an error when the value of the state query parameter is PUBLISHED

[slubar]

For the endpoint PUT /cve-id/:id, the query parameter 'state' can be used to set a RESERVED cve-id to REJECTED (if there's no corresponding CVE Record) and to set a REJECTED id (without a corresponding rejected CVE record) to RESERVED.

When the 'state' parameter value is 'PUBLISHED', the update should not occur since only POST/PUT /cve should be able to cause ids to be published. Currently, the state change does not happen, but a 200 response is returned indicating that it did happen.

Update modifyCveId to throw an error if the value of the state parameter is 'PUBLISHED'