Security fixes for ontology app

[davmlaw]

Summary

Applies security hardening to the ontology app identified in SACGF/variantgrid_private#3824. All findings require an authenticated session — no unauthenticated exploit paths exist.

• H1 (panel_app_ontology.py): URL-encode gene_symbol in the PanelApp OntologyBuilder cache key
• H2 (views_rest.py): Validate gene_symbol format with regex before serving/caching GeneDiseaseRelationshipView
• H3 (views_rest.py): Remove dead urllib.parse.quote call whose result was never assigned; requests.get params encode automatically
• M2 (models/models_ontology.py): get_from_slug now raises Http404 instead of letting DoesNotExist propagate as a 500
• M3 (views_autocomplete.py): Validate forwarded ontology_service param against the OntologyService enum
• M4 (views.py): Catch ValueError from OntologyService() constructor in ontology_term_text and raise Http404
• M5 (models/models_ontology.py): Narrow bare except Exception: to except ValueError: in get_or_stub
• M6 (models/models_ontology.py): Reject inputs over 200 chars in OntologyIdNormalized.normalize

Test plan

• Visit an ontology term page (MONDO, OMIM, HPO, HGNC gene) — confirm normal display
• Hit /ontology/term/<valid_term>/gene-list/ — confirm 200
• Hit /ontology/term/INVALID_SLUG/gene-list/ — confirm 404 (not 500)
• Hit the gene-disease-relationship endpoint with a valid gene symbol — confirm 200
• Hit the gene-disease-relationship endpoint with ? or / in the gene symbol — confirm 404
• Use the ontology autocomplete with a valid forwarded ontology_service — confirm filtered results
• Use the ontology autocomplete with an invalid forwarded ontology_service — confirm no crash
• Hit ontology_term_text URL with invalid service name — confirm 404 (not 500)