Add fixed dropdown option verification server-side

## Context
See ticket: https://cds-snc.freshdesk.com/a/tickets/29534

> After we received an answer for a dropdown field that did not match any of the fields we provided (said 'Mantioba' when the option was 'Manitoba'), we investigated if custom values could be injected into the value of the select in the HTML and go through without being validated. We confirmed this. We are flagging this in case it is an oversight in validation with the dropdown.

## Description

Form validation currently includes sanitization of field values, like escaping malicious content. We could go a step further by adding the ability to have a server action verify that a value from a "fixed" list matches.

e.g. a dropdown list of provinces, the value sent from the client is checked by the server action to see that it matches a province in the fixed list of options.

Start by tracing the existing form-validation and sanitization entry points, then inspect how fixed dropdown options reach the server action. Done means a submitted value that is not in the configured fixed list is rejected while a listed value remains accepted; add coverage alongside the validation tests.

Written by the indexing model from the issue text.