keywordSearch returns 0 for hyphenated terms like use-after-free, cross-site, and CVE IDs #175

Searching for a term with a hyphen in it returns nothing in the default (non-exact) mode:

for q in 'use-after-free' 'cross-site' 'CVE-2021-44228' 'log4j-core'; do
  curl -s -X POST https://search.cve.org/search -H 'Content-Type: application/json' \
    -d "{\"keywordSearch\":\"$q\",\"resultsPerPage\":1}" | jq -r --arg q "$q" '"\($q): \(.pagination.totalResults)"'
done
# use-after-free: 0
# cross-site: 0
# CVE-2021-44228: 0
# log4j-core: 0

For comparison, cross site as two words (cross* AND site*) returns 50,459.

Why I think this happens

searchQueryBuilder.js#L216-L217 escapes the term, and addWildCard adds a *, so OpenSearch receives use\-after\-free*.

• The query side. simple_query_string has analyze_wildcard off by default, so it turns that into a single prefix query on use-after-free. That query gets lowercased, which is why Apache and apache both return 4,010, but it isn't split into words.
• The index side. The description text, however, was indexed as separate tokens: use, after, and free. No indexed term starts with use-after-free, so nothing matches.
• Why some punctuation works. This fits the standard tokenizer, which splits on hyphens but keeps node.js and x86_64 together. That's why those two queries do work.
• Not the escaping. An unescaped use-after-free* behaves the same way, and the escaping from query_string omits escaping of reserved characters #63 should definitely stay.

I know the README describes this behavior ("each whitespace-delimited term receives a trailing prefix wildcard"). The trouble is that the design quietly returns zero for any term the analyzer splits, and that includes CVE IDs, CWE IDs, and a lot of everyday vulnerability vocabulary.

Possible fixes

• Turn on analyze_wildcard. With default_operator: AND, use-after-free becomes use AND after AND free*. That matches the words in any order rather than as a phrase, but it's far better than zero.
• For phrase matching, send split terms as match_phrase_prefix, or use multi_match with type: bool_prefix or match_bool_prefix.
• Add regression tests for hyphenated terms, CVE IDs, and CWE IDs.