Wrap PrivacyRequest approval/deny/complete inside transactions

[seanpreston]

Something that would be nice here is to wrap this new AuditLog creation into a transaction with privacy_request.save(...) — if one of these operations fails without the other we'd end up with an incomplete state, so it's better to commit them both at once.

Originally posted by @seanpreston in #1040 (comment)