Strings going through REST API should be sanitized before sending

[ichorid]

At this moment, when we send a string through the REST API we don't check if the string contains symbols that participate in request parsing, such as &?=, etc.
Consequently, the string could be broken down in a wrong way and/or manipulated for an injection attack.
For example, trying to download a torrent with & in its name results in a broken title in the downloads list that only contains the first word. (e.g. Cucumbers&Tomatoes will result in adding the download as just Cucumbers )

To solve it, we have to filter all our REST strings through urlencode filter, like described in
https://stackoverflow.com/questions/5607551/how-to-urlencode-a-querystring-in-python

Related to #3406

[ichorid]

Mostly solved by #4090. Solving it completely. Would require a complete redesign of our REST endpoints implementation. This work should be done as a part of formalization effort, like #3406