Bump WTForms and Flask-WTF to latest versions

WTForms versions less than 3.0.0 have a security vulnerability where
arbitrary HTML can be inserted into the label of a form, allowing the
possibility of a cross-site scripting attack.

I don’t know if there’s anywhere we put user-generated content into form
labels but it’s possible we are vulnerable somewhere.

This require moving some imports because as of
https://github.com/wtforms/wtforms/pull/614/files
there is no longer a separate module for HTML 5 fields, they are now
considered core fields.

As of https://github.com/wtforms/wtforms/issues/445/files custom
implementations of `pre_validate` or `post_validate` must raise
`ValidationError` to trigger a validation message, where we were raising
`ValueError` this was no longer being caught.

As of https://github.com/wtforms/wtforms/pull/355/files `StringField`
returns `None` for empty data, not `''` but our `validate_email_address`
function only accepts strings.

app/main/forms.py

@@ -22,6 +22,7 @@ from werkzeug.utils import cached_property
 from wtforms import (
     BooleanField,
     DateField,
+    EmailField,
     FieldList,
     FileField,
     HiddenField,
@@ -30,13 +31,14 @@ from wtforms import (
 )
 from wtforms import RadioField as WTFormsRadioField
 from wtforms import (
+    SearchField,
     SelectMultipleField,
     StringField,
+    TelField,
     TextAreaField,
     ValidationError,
     validators,
 )
-from wtforms.fields.html5 import EmailField, SearchField, TelField
 from wtforms.validators import URL, DataRequired, Length, Optional, Regexp
 
 from app.formatters import format_thousands, guess_name_from_email_address
@@ -542,7 +544,7 @@ class RadioFieldWithRequiredMessage(RadioField):
         try:
             return super().pre_validate(form)
         except ValueError:
-            raise ValueError(self.required_message)
+            raise ValidationError(self.required_message)
 
 
 class StripWhitespaceForm(Form):