API not handling values with encoded characters

[simonjupp]

We saw queries like /spot/zooma/v2/api/services/annotate?propertyValue=animal+ovary&propertyType=organism+part&filter=required:[atlas,gwas],preferred:[atlas,gwas],ontologies:[uberon,efo%0D%0A]. The additional characters in the ontologies parameter are causing Zooma to become unresponsive.

The error in the logs was 2019-07-22 09:50:15,277 ERROR [http-bio-8080-exec-16] access.Zooma (Zooma.java:674) - Unexpected exception [QueryParseException: Lexical error at line 53, column 34. Encountered: "\r" (13), after : "\"efo"] which then triggered a bunch of search timeout exceptions

2019-07-22 10:09:40,981 ERROR [ui-search-thread-26] web.ZoomaMappingController$2 (ZoomaMappingController.java:373) - Problems annotating 'Property 'Microtubule clumps'' (SearchTimeoutException: Search for 'Microtubule clumps' took too long)
2019-07-22 10:09:40,986 ERROR [search-completion-monitor-280979] web.ZoomaMappingController$3 (ZoomaMappingController.java:436) - A job failed to execute - there are 1 fails now.  Error was:

uk.ac.ebi.fgpt.zooma.exception.SearchTimeoutException: Search for 'CD4-positive' took too long
	at uk.ac.ebi.fgpt.zooma.access.Zooma.waitForResults(Zooma.java:381)
	at uk.ac.ebi.fgpt.zooma.access.Zooma.annotate(Zooma.java:294)
	at uk.ac.ebi.fgpt.zooma.web.ZoomaMappingController$2.call(ZoomaMappingController.java:362)
	at uk.ac.ebi.fgpt.zooma.web.ZoomaMappingController$2.call(ZoomaMappingController.java:342)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
	at java.lang.Thread.run(Thread.java:745)
Caused by: java.util.concurrent.TimeoutException
	at java.util.concurrent.FutureTask.get(FutureTask.java:205)
	at uk.ac.ebi.fgpt.zooma.access.Zooma.waitForResults(Zooma.java:353)
	... 9 more

Zooma wasn't able to recover or accept any new queries after this.