Prefer `json_response` where applicable.

Fix milestone titles being leaked using search API
when users cannot read milestones

#46469 - Added ref querystring parameter to project search to allow searching on branches other than master

as the params block is evaluated when loading the class and the db
connection is not available yet we can't use the feature toggle inside
that block.

Added: Specs for the API action

Updates specs to use new rails5 format.

The old format:
`get :show, { some: params }, { some: headers }`

The new format:
`get :show, params: { some: params }, headers: { some: headers }`

Hooks were run for wikis, but given the internal API wasn't responding
failures happended, as seen on:
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/18693

'/-/' delimiter is used only in UI, in API we don't use it for
other endpoints. To align search endpoints with the rest of API
endpoints, this patch makes '/-/' optional for existing endpoints (to
keep backward compatibility).

Documentation is updated to prefer paths without '/-/'.