pullrequests: allow closing only by author and admin

A pullrequest should not be closable by any reviewer, especially not since
there is no reopening feature.

The check on change_status is no longer necessary, as the new permission
check is more restrictive.