fix: Ensure that all API endpoint URLs are constructed safely.

[kpfleming]

#543 will be reverted before this PR is merged, as this achieves the same result (disallowing injection of path elements in serviceID fields).

As discussed in our chat today, this PR adds a ToSafeURL function which accepts a slice of strings that are used to construct the API endpoint URL. Each string is checked for unacceptable values (currently just ..) and passed through url.PathEscape. The result is that if any components contains a 'special character' which could affect parsing or routing of the resulting URL, it will be URL-encoded for safety.

I attempted to find all places where API endpoint URLs were being constructed from one or more components dynamically, but it is certainly possible that I missed some!

While this PR touches a lot of files, I find that the code is more readable now, as the URL-construction process isn't polluted by Sprintf format strings.

[kpfleming]

Also, I am fairly certain that all of these changes are correct, as during development when I made mistakes (more often than I wished) the existing tests caught those mistakes. Assuming we have 100% test coverage for the modified files, these changes should effectively be a no-op when proper data is provided to the API operations.

[kpfleming]

If we wanted to get extra fancy we could improve ToSafeURL to receive []interface instead of []string, and then it could handle formatting the integers itself. That would eliminate most of the integer-formatting in the PR, except for one case where the resulting string has to be zero-padded.

[cee-dub]

Just some stylistic comments. Thanks for doing this! Lots of manual conversion.

[kpfleming]

I've addressed the feedback and also added unit tests for the new helper function. Also, most of the conversion wasn't manual, it was done using some complicated sed substitutions :-)

[cee-dub]

If we wanted to get extra fancy

I really like that it isn’t fancy.

[cee-dub]

Looking good!

[cee-dub]

Merge this baby.

[Integralist]

LGTM. 🚀