Test pagination edge cases once instead of per controller

What does this MR do and why?

Resolves #668 (closed)

The 'a paginated endpoint' shared example tested every edge case of PaginationConcern (non-numeric, hash, array and non-positive page and page_size, default page size) and was included in four request specs: bonus_points, leaderboard, organizations and rewards. The same 14 examples ran once per controller, through the full request stack, to check behaviour that lives only in the concern.

This MR:

• adds spec/requests/pagination_concern_spec.rb, which tests the concern once through an anonymous controller, following the pattern of spec/requests/api/v1/api_application_controller_spec.rb. It paginates a plain array with Kaminari.paginate_array, so it needs no factory or database record.
• reduces the shared example to the two checks that depend on each endpoint: the metadata against its real records, and the record returned on page 2.

Pagination examples go from 56 to 22.

include PaginationConcern carries a rubocop:disable RSpec/DescribedClass: the controller block runs through class_exec on the anonymous class, where described_class is not defined.

Validation steps

1. bundle exec rspec spec/requests/pagination_concern_spec.rb
2. bundle exec rspec

/cc @leetickett-gitlab