Validate availability string

[MinhxNguyen7]

Description

I think we currently just save whatever availability string that the client sends into the database.

This poses a XSS risk because we would then send this unsanitized input (from the frontend perspective) from one client to another. In theory, this should be ok if the way that we parse the json string on the frontend is secure, but this poses a risk regardless.

More importantly, we don't want there to be an availability string that is malformed/inconsistent from a bug to be entered without checking into the database.