Unify some of the appid code, improve script tag detection and add validation

[AE-MS]

Description

The codebase currently has some duplication in a few areas:

• Multiple different ways of accepting, storing, and validation of app ids
• Multiple (different) ways of identifying the presence of script tags

Main changes in the PR:

1. Unify all App Id logic around the AppId type -- note: the input parameters for appids unfortunately cannot be changed from string to AppId at this time since that would be a API-breaking change.
2. Remove incomplete implementation of HTML entity decoding (since it was missing a lot of other entities) and remove need for such functionality by just looking specifically for encoded script tags (script tag searching was the only function using the entity decoding helper)
3. All related tests that were using a regex to test for a specific substring were updated to be case-insensitive, since they are intentionally not looking to exact match the error message (the exact error message is not part of the API contract)
4. Explicitly added unit tests for validate the hasScriptTags function
5. Updated unit tests for functions that were doing app id validation to no longer test on the exact error message (it's not part of the API contract) and only test for the presence of a descriptive word (in a case-insensitive way). Relatedly: updated these tests to more directly use Jest-provided affordances for testing async functions that throw errors.
6. Updated unit test usage of domains not controlled by Microsoft to use Microsoft-owned domains

Validation

Validation performed:

1. All existing and new unit tests were run and passed
2. Private helper functions that previously didn't have specific unit tests now do

Unit Tests added:

Yes

End-to-end tests added:

No

Additional Requirements

Change file added:

Yes

Next/remaining steps:

There are still a few places that use the old validateId function but that I did not change to use AppId. This is because the data being validated were not actually an app ids -- they are fields like "title id" and "oauthConfigId". It's not clear why these other ID types were using the app id validation code so I can't tell whether to unify them now. I have questions out to the owners about this and will follow up in a subsequent change.

[erinha]