Endpoint can only be called from CI with a job token. DAST site validation must
belong to the current project, and the transition must be valid.

- Add new Grape API defition
- Add specs
- Extract helper to allow it to be shared
- Add feature flag