refactor: use res.json if backwards compatible with client

[mantariksh]

Problem

Usage of res.send creates the risk of HTML injection attacks if not used with care. Using res.json is better practice.

Solution

This PR addresses the cases where changing from res.status to res.json is compatible with the client.
When the client does not use the content of the response body, it is safe to change res.send to res.json, wrapping the original string in an object. For example, the client sometimes does its own success/error handling, or simply logs errors to the console. This applies to the following API endpoints:

• GET /billing
• POST /:formId/adminform/feedback
• POST /:formId/feedback
• GET /spcp/redirect
• GET /spcp/validate
• GET /auth/signout
• GET /user
• Generic error handling for celebrate errors