Improve approach for handling bad characters in most endpoints

[slubar]

The index.js files for the cve, cve-id, and org controllers include numerous calls to the validate.js function escape() to convert the characters <, >, &, ', " and / to HTML entities. This has been deemed necessary to avoid some types of malicious attacks. However, rather than converting the characters to HTML entities, it would be better to throw an error indicating that the input is invalid.

[david-rocca]

After discussion, the subset of restricted special characters will be reduced to <, >, and ".