Strike status filter accepted arbitrary strings in cobc-events

`/api/strikes` previously accepted any comma-separated string in `?status=` and forwarded it to the service layer without validation against the StrikeStatus enum.