fix: [API] don't html encode JSON documents

- earlier fix broke shit
- sometimes we pass the type as json sometimes as application/json to the response class, which handles it cleanly - but the check only accounted for one case

app/Controller/Component/RestResponseComponent.php

@@ -648,7 +648,7 @@ class RestResponseComponent extends Component
                 } else {
                     $prettyPrint = !$this->isAutomaticTool(); // Do not pretty print response for automatic tools
                     $response = JsonTool::encode($response, $prettyPrint);
-                    if ($format !== 'json') {
+                    if ($format !== 'json' && $format !== 'application/json') {
                         $response = h($response);
                     }
                 }