During #inc-274 we found that both the site-config and global-settings lack any form of input validation.

A user could set a key like this

{
  "message": "javaref[https://sourcegraph.com]",
}

(warning! If you set this you will need to go into the database to remove it from the global settings)

in the global settings which would result in code-nav breaking.

Requests

Perform input validation of site-config and global-settings to prevent erroneous keys from breaking other features.

Concerns

Deprecation of site-config options during upgrades could be an issue

@eseliger mentioned we used to have this but now we do not?