A few filter validation gaps: cweId format, CVSS NONE severity, and CVSS metric tokens #179

These are all minor. Normal inputs work fine; the problems show up with malformed or edge-case inputs.

1. cweId doesn't check the format

cweId accepts up to 32 characters (constants.js#L16) and falls through to a match_phrase query (searchQueryBuilder.js#L353).

That behavior is consistent with an analyzed text field, where CWE-79 gets indexed as cwe and 79. I'm inferring that from the results, though; the readiness check (searchReadiness.js#L73-L79) accepts either text or keyword for this field.

Suggestions:

• Validate against the CVE schema's pattern, ^CWE-[1-9][0-9]*$, case-insensitive and normalized to upper case.
• Match on a keyword sub-field, and add that sub-field to the readiness check.
• Accepting a comma-separated list would be a nice extra.

2. NONE isn't accepted as a severity

cvssV3_1Severity: "NONE" returns INVALID_CVSSV3_1_SEVERITY, because the allowed values are LOW|MEDIUM|HIGH|CRITICAL (middleware.js#L10). NONE is a valid baseSeverity in the FIRST CVSS v3.0, v3.1, and v4.0 schemas. (v2 has no severity label, and the API maps it from the score.) The query already does an upper-cased term match on baseSeverity, so only the list of allowed values needs to change.

Suggestions:

• Add NONE for the v3, v3.0, v3.1, and v4 severity fields.
• It would also help to note in the docs that v2 filters by score while v3 and v4 filter by the baseSeverity label the CNA supplied.

3. CVSS metric tokens aren't checked, and version prefixes are ignored

• cvssV3Metrics: "FOO:BAR" returns 200 with 0 results rather than an error.
• The CVSS:3.x/ prefix is stripped before matching (cvss.js#L13-L19). As a result, cvssV3_1Metrics: "CVSS:3.0/..." is accepted and matched against v3.1 vectors only, and the version in the prefix is silently ignored.

Suggestions:

• Validate metric names and values for each CVSS version, and return 400 for anything unknown.
• Reject a version prefix that doesn't match the field.