The API is pretty lax about lang values, and will try to return a matching localization for an addon (etc) if available. In api/v5+ we return the requested lang as null if it's not found - if the lang value is garbage data (defined containing other than alphanumeric characters + _, -) we should return a 400 instead of returning a normal response (in api/v5+ because breaking change).

┆Issue is synchronized with this Jira Task