Stricter parsing of GET request inputs
Parsing arguments for, e.g., the get-leaves end point, uses any last two components after splitting url path on '/'. This means that it allows and ignores arbitrary intermediate components. E.g., the valid request
GET poc.sigsum.org/jellyfish/get-leaves/0/1
is treated the same as
GET poc.sigsum.org/jellyfish/get-leaves/xxx/0/1
which seems wrong.