ecurity: Validate and sanitise input in all write resources

Problem/Motivation

The module exposes public write endpoints for contact forms, appointment requests, reviews, likes and view counters. User-supplied payloads are written to entities with limited validation, which risks stored XSS, oversized payloads and invalid entity references.

Proposed resolution

• Define a validation constraint set per endpoint (required fields, max length, email/phone format, allowed referenced bundles).
• Run entity validation via $entity->validate() and return 422 with the constraint violations.
• Ensure all user text is stored with a restricted text format and never rendered raw.

Remaining tasks

Audit every *AddResource plugin and implement validation.

User interface changes

None.

API changes

Invalid payloads return 422 with a structured violation list.