[reports] Expiration of reports

As with attestations, reports should also expire, so the workflow for both of them is similar. Contrary to attestations, we should not simply delete expired reports, as users put effort and time tunning them. What we should do is to remove the lock and revert the report to an editable state again. At this point, we need to make sure to reset the report number to a different one, so that any links to it will now be broken.

This makes the work flow for both types of objects be the same while preserving reports.