Add proxy API for submitting grades to Blackboard

[seanh]

Belongs to epic: #662
Proof of concept: #945

Add a proxy API for our JavaScript code to call, when a teacher enters a grade for a student/assignment, to submit that grade to Blackboard.

This card is just about adding the API. There'll be a separate card for getting the frontend code to call the API.

See also

• The LTI 1.1 Basic Outcomes spec. This is the spec for the API that we'll use for submitting grades to, and reading grades from, Blackboard. Blackboard does not have any docs of its own for this

Done when

• You can curl a proxy API with lis_outcome_service_url, lis_result_sourcedid and score params, and correct Authorization header, and the given score will appear in Blackboard's Grade Center
• You can call the same API again with the same params, but a different score, and the score will be updated in Grade Center
• If any of the params lis_outcome_service_url, lis_result_sourcedid or score are missing or invalid our API sends back a JSON validation error response with appropriate HTTP status code (please see existing proxy APIs for Canvas for response format and status code)
• If the Authorization header is missing or invalid our API sends back a JSON authorization error response with appropriate HTTP status code (please see existing proxy APIs for Canvas for response format and status code)
• If we receive an error, invalid or unexpected response from Blackboard our API sends back a JSON error response with appropriate HTTP status code (please see existing proxy APIs for Canvas for response format and status code)
• If the request to Blackboard times out or has some sort of network failure our API sends back a JSON error response with appropriate HTTP status code (please see existing proxy APIs for Canvas for response format and status code)

Notes

We already have an API for submitting LTI launch URLs to Canvas. We now require an API for submitting numeric grades to Blackboard.

The parameters of this API call need to be:

1. Authorization (can be either a request parameter or a header): the JWT for authenticating to our API
2. lis_outcome_service_url
3. lis_result_sourcedid
4. score (grade)

There's an existing LTI outcomes service that is capable of submitting grades to Blackboard: https://github.com/hypothesis/lms/blob/master/lms/services/lti_outcomes.py

It's going to be simpler and better to have different APIs for submitting different types of object (launch URL, grade, ...) to different LMS's, rather than trying to create a single API endpoint that can handle everything. The existing Canvas submission API has completely different params (document URL, Canvas file ID, h username, ...) and the view contains different logic that is irrelevant to Blackboard (particularly around repeat submissions) and is used differently (e.g. called at different times). There are already multiple different cases within Canvas grading (URL vs Canvas file assignments) and if we add the further case(s) of non-Canvas grading to the same API endpoint and code paths, we are going to get a mess. Separate and keep simple.

The score that we post to Blackboard needs to be between 0.0 and 1.0, as per the LTI spec. This is regardless of what the teacher has set the "Points Possible" to in the assignment settings in Blackboard. Teachers can configure assignments to be graded out of 5, 10, 100, 27, whatever they want, the LTI app still needs to submit a number between 0.0 and 1.0 or Blackboard will give us an error.