Consider sanitation of form definitions via CRUD API

[ebruchez]

Right now, the CRUD API just takes form definitions and form data and forwards them to persistence providers to save them.

We have a request to sanitize specifically form definitions, to help prevent injections. One question was whether this is needed or useful, or whether #6533 covers sufficient ground.

It would be good to be able to validate form definitions upon PUT, as a general option. HTML sanitation could be part of that.