Remove a reported phishing message, and restore it if an admin marks it safe

When a user reports a message as phishing, remove it from the Inbox without permanently deleting it. If an admin later determines it is safe, move it back to the Inbox.

Today, a Phish report only creates a review item and sends a ticket to our PSA. A spam report already moves the message to Junk, and the user can restore it. We want that same reversible behavior for phishing, so a reported phish doesn’t sit in the user's Inbox while we review it.