Send audit emails to more users

Summary:
Audit has some weird rules about who gets email. Make them less weird:

• When a user does "Add Auditors", email the auditors.
• When a commit is commented on, email anyone in "concern" or "audit required" states.

@staticshock, my claim that I can't reproduce was crazy, I just have weird test data and read it wrong.

Test Plan: Added a user to an audit and verified they got an email.

Reviewers: btrahan, chad

Reviewed By: btrahan

CC: staticshock, aran

Differential Revision: https://secure.phabricator.com/D6414