Add exact multi-CWE searches and validate CVSS filters

[afoote-mitre]

Summary

POST /search now supports exact matching for one or more CWE IDs through cweIds, rejects malformed CWE and CVSS metric inputs before querying OpenSearch, and accepts the valid NONE severity for CVSS v3 and v4.

The request field changes from cweId to cweIds. For example, {"cweIds":"CWE-79, cwe-89"} matches records containing either complete identifier within the selected CNA/ADP scope. The former cweId field is rejected as unsupported.

Closes #179.

Changes and Primary Files

Change	Why It Was Needed	Primary Files
Accept and validate multiple CWE IDs	CWE requests previously accepted a single analyzed string, allowing malformed values such as 79 or CWE to produce broad matches. The new cweIds field follows the comma-separated input pattern of cveIds: trims entries, handles case-insensitive identifiers, deduplicates matching values, and matches any requested ID. Arrays, empty entries, or any malformed ID reject the entire request with HTTP 400 CWE_IDS_FORMAT. Limits are 100 supplied IDs before deduplication, 32 characters per ID, and 4,096 characters overall. Format-valid IDs without indexed matches do not discard other matching IDs.	controllers/middleware.js, routes/index.js, utils/constants.js, utils/errors.js
Match complete CWE identifiers in the selected scope	Analyzed text matching made identifier behavior dependent on the text analyzer. Case-insensitive exact term queries now use CWE .keyword fields, with OR between IDs and eligible container fields. The CWE filter is combined with other search filters using AND.	utils/searchQueryBuilder.js, utils/searchScope.js
Require keyword support for CWE search readiness	Readiness previously accepted analyzed text fields for CWE searches. It now checks the keyword fields used by the exact queries, retaining the existing alternative-field behavior for CNA and ADP. Both keyword fields were confirmed searchable in the deployed dev index; no index changes are included.	utils/searchReadiness.js
Accept CVSS NONE severity	CVSS v3.0, v3.1, combined v3, and v4 can store NONE as a severity, but validation previously rejected it. These filters now accept NONE case-insensitively. CVSS v2 continues to use the LOW/MEDIUM/HIGH score ranges.	controllers/middleware.js, utils/errors.js, utils/constants.js
Validate version-specific CVSS metric tokens	Unknown metric names or values and conflicting repeated metrics previously reached OpenSearch and could silently return zero results. Invalid filters now return HTTP 400 CVSS_METRICS_FORMAT; valid partial vectors and optional metrics remain supported.	utils/cvss.js, controllers/middleware.js, utils/errors.js
Honor CVSS version prefixes throughout matching	Prefixes were previously stripped without enforcing their version. A prefix must now match the selected filter. For cvssV3Metrics, an explicit CVSS:3.0 or CVSS:3.1 prefix restricts candidate retrieval and semantic matching to that version; omitting it searches both versions. All supplied tokens must still match one eligible vector.	utils/cvss.js, utils/searchQueryBuilder.js
Document the accepted inputs and error responses	Callers need the new cweIds field, its OR and scope behavior, limits, and validation errors documented consistently. The parameter descriptions and examples also explain CVSS prefixes and tokens and severity labels versus score ranges.	README.md, routes/swagger.js, api-docs/openapi.json, test/postman/buildCollection.js, test/postman/CVE-Search-API.postman_collection.json

Regression coverage is included in controllers/middleware.test.js, controllers/searchController.test.js, routes/search.integration.test.js, utils/cvss.test.js, utils/searchQueryBuilder.test.js, utils/searchReadiness.test.js, utils/errors.test.js, and api-docs/openapi.test.js.