fix: resolve & in url upon redirect, shift prefill to textfield component

[tshuli]

Problem

• This PR resolves the issue of & being html-encoded as & upon redirect, which is not valid URI
• Also shifts the stealth prefill feature from the field directive to the textfield component
• Closes Investigate why & character in non-hashbang url query params is encoded to & upon redirect #531

Solution

• Replace & with & in the ejs template. This was preferred to allowing all characters to be escaped, which may possibly introduce a security vulnerability

Before & After

The following non-hashbang URL will be redirected as follows:
https://form.gov.sg/<formId>?<fieldId1>=abc&<fieldId2>=xyz

BEFORE:
https://form.gov.sg/#!/<formId>?<fieldId1>=abc&amp;<fieldId2>=xyz

AFTER:
https://form.gov.sg/#!/<formId>?<fieldId1>=abc&<fieldId2>=xyz

Tests

• Create a form with short text field. Open in public view with the query params =, where comprises alphanumeric/hyphen/underscore characters. Check that the short text field is not prefilled with value1
• In the db, check that allowPrefill is set to false for the short text field. set allowPrefill = true. Check that prefill now works.
• Create myinfo field. Set allowPrefill = true for the myinfo field. Access form on public view and login to singpass. Check that prefill does not work on the myinfo field.
• Check that prefilling works even without the hashbang in the url
• Check that for non-hashbang url with two query params, upon redirection, the redirect path uses & to separate the query params instead of &
• Add radio button to the form. Set form logic to hide the short text field conditional on the radio button. Check that the short text field is prefilled when it is unhidden
• Prefilled field value is cleared when field is hidden by logic at the point of submission

Deploy Notes

dependencies

• he module has been removed

[mantariksh]

some comments on the tests!

[liangyuanruo]

to address @mantariksh 's comments before approval

[tshuli]

@mantariksh thanks for the comments, edits for your re-review :)

[tshuli]

@liangyuanruo @mantariksh please review before next release :)

[mantariksh]

a couple of nits:

1. logger meta.action has been standardised to the calling function so it's easier to understand logs
2. we always return res.status(...).json(...) to prevent mistakes in the future where code is written after res.send.

otherwise lgtm!