Preprint API security fixes: owner data exposure, owner publishing, title XSS, search scope

[ajrbyers]

Fixes five problems in the preprint API that are already in 1.9. None are introduced by #5612.

Fixes

1. The preprint API exposed owners' account records. PreprintSerializer has depth = 2 and lists owner, so every preprint returned the owner's full Account row: password hash, email, activation and confirmation codes, is_superuser and so on. That includes the public, anonymous /api/published_preprints/ endpoint. owner is now the account's ID only. Affects r-v1.9.x, v1.9-RC-1 and master; the 1.8 releases don't list owner and are not affected.
2. Owners could publish through the API. On /api/user_preprints/ an owner could set stage, date_published, date_accepted, preprint_doi, owner and repository, and edit preprints after submission. A new UserPreprintSerializer makes it match the web submission flow:
   • Owners can create a preprint unsubmitted or in review, and submit an unsubmitted one. Any other stage is a 400.
   • Owner and repository are always the requesting user and site; publication and acceptance dates and the preprint DOI are cleared.
   • Submitted preprints return 403; they change through the version queue.
   • Submitting through the API also keeps date_submitted, which was previously wiped.
3. Preprint titles were not sanitised but are rendered with |safe in about 50 templates. Preprint.title, PreprintVersion.title and VersionQueue.title are now JanewayBleachCharField, as Article.title is. Migration repository 0059 sanitises existing titles that contain <. The citation_title meta tag now uses striptags, since sanitising alone does not stop a " breaking out of the attribute. The version form keeps its plain text input.
4. ?search= on /api/preprints/ returned a 500 (it filtered on account__institution, which doesn't exist), and the result set was not restricted to the current repository. Fixing only the error would have listed other repositories' preprints. Search now runs in the database within the current repository, and affiliation search uses the author's ROR or custom organisation name.
5. Repository managers got 403 from the licences API, because it required them to be a repository manager and a journal editor. It now takes either.

Testing

• New tests in api/tests/test_user_preprints_api.py cover each fix.
• api and repository test suites pass.
• Also exercised by hand over HTTP, together with Preprint authors use the journal FrozenAuthor system; updates are moderated drafts #5612, on Postgres with two repositories (47 checks: public, manager, owner, files, version queue and account endpoints).

Merging with #5612

#5612 rewrites the same search block for FrozenAuthor and already restricts it to the repository; keep its version. Migration 0059 here becomes 0062 after #5612's 0059–0061.