Several of our endpoints allow fetching all records of that type.

Several of our endpoints allow fetching all records. We should really handle this in some way.

The way I see it, we have two choices
1. Enforce query requirements. If those query requirements are not met (for example, a list of ids), we can
- Raise a custom error and return that error as a response
- Return 0 results
2. Limit index/all requests to X records

List of endpoints that allow this
- `category`
- `comment` (after merging #372, could've fixed there, but figured we should handle it all after a discussion)
- `donation_goal`
- `organization`
- `project_category`
- `project_controller`
- `project_skill`
- `role`
- `role_skill`
- `skill`
- `task`
- `user`
- `user_category`
- `user_role`
- `user_skill`

Obviously, not all of these are as troublesome, but we should probably handle them all as consistently as it makes sense.