Strengthen CPE validation and remove search telemetry

[afoote-mitre]

Summary

• Strengthen cpeName and virtualMatchString validation so malformed CPE 2.3 inputs fail with deterministic HTTP 400 responses.
• Add response warnings for broad virtual match strings and abbreviated CPE names whose omitted trailing components default to wildcards.
• Remove the temporary search performance telemetry implementation and its runtime configuration while preserving request deadlines, cancellation, readiness checks, and request logging.
• Update OpenAPI documentation, generated Postman coverage, and supporting unit and route tests for the revised behavior.

Why These Changes Were Needed

• Invalid or incomplete CPE syntax could previously be accepted and produce a misleading empty result set instead of identifying the request problem.
• Valid but broad or abbreviated CPE requests can produce wider matches than a caller expects; structured warnings now explain how those requests were interpreted before records are returned.
• The in-application telemetry was introduced for pre-release performance investigation and is no longer intended to be part of the public API codebase.
• Contract documentation and generated client tests needed to stay synchronized with the validation and warning changes.