Need to ensure strings are correctly escaped when manually building JSON responses (we do this for some small efficiency reasons). We already do this in some places via ConvertToJSONString, need to make sure this is used comprehensively.
Same general issue as
CBG-661, but that fix was too narrow.
from handler.writeRawJSON, handler.writeRawJSONStatus