Flag evidence for an information request

Flags evidence for an information request when it doesn't meet audit requirements, marking issues that need to be addressed before approval. This action changes the request's approvalStatus to a flagged state and creates an activity log entry.

Flagging workflow:

1. Auditor reviews submitted evidence
2. If issues are found, auditor calls this endpoint with detailed reason
3. Request status changes to flagged state
4. Customer is notified and can see the reason in activity logs
5. Customer addresses issues and updates evidence
6. When ready, customer changes status back to awaiting review
7. Auditor reviews again and either flags again or accepts

The reason field should clearly explain what's missing or incorrect so the customer knows exactly what to fix. This reason is visible to the customer and appears in the activity log.