Strengthen search endpoint validation #1745

Update: The below (stricken) finding was deemed to be compliant with ASVS 3.0.1, Requirement 5.10, but a true positive finding.

Related to #1724. We should consider strengthening validation of our search endpoint, by either explicitly specifying an acceptable Marshmallow schema or by constraining the accepted query to an allow-list of fields, operators, and query types.

To ensure compliance with ASVS 3.0.1 per contract requirements, we should implement the below requirement.

> Verify that all SQL queries, HQL, OSQL, NOSQL and stored procedures, calling of stored procedures are protected by the use of prepared statements or query parameterization, and thus not susceptible to SQL injection.

Note: The Finding and Proposed change sections below are mostly Claude-generated with manual human review for false positives. Ultimately, we are bound by the text of the requirement above.

Finding:

> The provider search endpoint accepts a raw, caller-supplied OpenSearch DSL query body rather than a parameterized query: SearchProvidersRequestSchema.query is a marshmallow Raw field (lambdas/python/common/cc_common/data_model/schema/provider/api.py:507) passed through to OpenSearch unchanged (lambdas/python/search/handlers/search.py:437-439). Staff control the entire query structure. This is well-mitigated — per-compact index isolation, a validate_no_cross_index_queries check, the domain setting rest.action.multi.allow_explicit_index: false, and response-sanitization schemas — but the unbounded DSL still allows expensive/abusive queries (query-cost DoS) and is a wide input surface that is not parameterized. Related: #1724 (a dateOfBirth scope-gate bypass via the same raw-DSL pattern in the social-work/cosmetology apps; that specific gate does not exist in compact-connect, but the raw-DSL passthrough does).

Proposed change:

> Constrain the accepted query to a parameterized allow-list of fields, operators, and query types rather than passing raw OpenSearch DSL, or wrap it with query-cost limits and depth/clause caps. Treat DSL fields as data, not structure.