Moves spam state management to model, and action/behaviour
to a SSoT SpamActionService. Only show reCAPTCHA if the
spammable object is flagged `needs_recaptcha`.

SpamActionService now prepares the request info and then
asks SpamVerdictService what to do and tells the object
to change its state based on the result.