* vocabulary is currently available in wb2 for collections, projects.
* add config parameter to API/VocabularyPath, Collections/VocabularyPath, expected to be local to the machine the controller runs on.
* the vocabulary file will be cached by controller; file timestamp will be checked on any request. If the vocabulary file can't be read (e.g. permissions, invalid json, etc), the existing cached version will be used and a health warning/prometheus alert should be raised.
* if the file can't be read on startup, that's an error. config-check should also check this.
* apply validation before save/update requests. Admin users do not get special treatment.
* the validation code should handle existing data gracefully: if tags are not being changed but are invalid, updates to other fields in the collection should still be permitted.
* change wb2 to get the file from controller (it will need to export the cache copy as a valid json url)