Fix CPE patch-letter ordering and define prerelease stages

[afoote-mitre]

Summary

Fixes CPE version ordering that treated bare patch letters such as 1.0.2a as prereleases and incorrectly placed 1.1.1l after 1.1.1m. The API now distinguishes bare patch letters from numbered prerelease aliases, so valid ranges such as 1.0.2 through 1.0.2a are accepted and evaluated consistently.

This PR also defines distinct dev, pre, and preview prerelease stages. The documented order is:

dev < alpha < beta < milestone < pre < preview < rc < snapshot < release < sp < unknown qualifiers

pre, preview, and rc are separate stages, not equivalent aliases. This is an explicit API extension to Maven-style qualifier precedence.

Changes and Primary Files

Change	Why It Was Needed	Primary Files
Apply short aliases only to directly numbered qualifiers	a, b, and m were unconditionally translated to alpha, beta, and milestone. This made bare patch letters sort before the release and broke ordering among patch versions. Tokenization now preserves character positions long enough to recognize a directly following digit: 2.0a1 remains a prerelease, while 1.0.2a sorts after 1.0.2. A separator between the short letter and number does not activate the alias.	utils/cpe.js
Recognize distinct development and preview stages	The labels dev, pre, and preview previously sorted after the release as unknown qualifiers. They now have explicit prerelease positions, with pre < preview < rc. Numeric suffixes are compared numerically, matching remains case-insensitive, and unrelated labels such as previewish remain unknown qualifiers.	utils/cpe.js
Apply the corrected ordering throughout CPE range handling	The shared comparator determines requested range validity, concrete cpeName applicability, and virtualMatchString interval overlap. The fix therefore corrects both incorrect HTTP 400 range-order rejections and incorrect range inclusions/exclusions. Exact criteria versions continue to use literal matching.	utils/cpe.js; regression coverage in utils/cpe.test.js and routes/search.integration.test.js
Document the comparison policy and examples	Users need to distinguish numbered prerelease aliases from literal patch letters and understand the added prerelease stages. The README and Swagger descriptions now show the ordering and identify the additional stages as API policy rather than strict Maven behavior.	README.md, routes/swagger.js, generated api-docs/openapi.json
Add repeatable Postman range examples	Accepted and inverted patch-letter, numbered-alias, and prerelease ranges need observable API examples. Positive examples use a pre-1999 CVE ID so range acceptance can be checked without requiring indexed OpenSSL applicability data; OpenSearch must still be available.	test/postman/buildCollection.js, generated test/postman/CVE-Search-API.postman_collection.json

Deferred Scope

Addresses the alias defect and qualifier-policy suggestions in #176. versionType-specific evaluators remain deferred because versionType belongs to affected[].versions[], not cpeApplicability. Supporting affected-product/version searches requires a separate feature decision; this PR does not add affected-array matching or infer a versioning scheme from another part of a record.