fix: use $eq for history.prime query in getAllVersions

[cubap]

Summary

Ports the one still-relevant change from #211 (which is being closed as superseded): the NoSQL injection fix in getAllVersions.

controllers/utils.js builds a MongoDB query from a user-derived @id:

db.find({ __rerum.history.prime: rootObj['@id'] })

If @id is a query object (e.g. {$ne: null}), MongoDB interprets it as an operator, allowing query injection. Wrapping the value in $eq forces it to be treated as a literal:

db.find({ __rerum.history.prime: { $eq: rootObj['@id'] } })

This is the same fix that closed code-scanning alert #69 on the #211 branch; the equivalent alert remains open on main (js/sql-injection, controllers/utils.js).

Validation

• __tests__/utils.test.js + __tests__/routes_mounted.test.js: 70/70 pass
• routes/__tests__/release.test.js: 3/3 pass (release logic uses getAllVersions)

Related

• Closes the code-scanning alert for the getAllVersions query
• Supersedes the security portion of Code optimization: modernize JavaScript patterns and improve consistency #211