Add support for quoted (default) MongoDB search term values in SearchQueryParser (6.1)

[graylog-internal-actions-access]

Note: This is a backport of #21567 to 6.1.

Description

Add support for quoted default search terms (those that don't specifically indicate a field name) when performing entity searches on various pages throughout the application where the MongoDB SearchQueryParser is used. The underlaying problem is explained in detail in the source issue #21565.

TLDR: When multi-word entity search terms are provided in quotes (e.g. "My Event Definition"), they will no longer be split into separate search terms by word. This prevents an excessive number of results from being returned, which can be confusing (and not what I think folks will expect). The words are still split into separate terms when no quotes are supplied.

This also adds consistency with how field-specific terms work and respect quotes. For example, currently, when searching for title:"My Event Definition", only the whole quoted value is searched. It seems to follow that non-field specific values should work the same way.

Note that I am not a regex expert, but I did try to break-up the long splitting expression into chunks with corresponding documentation to improve maintainability. Please let me know if anyone has advice for improving the expression

Motivation and Context

Fixes #21565

This issue was discovered while providing support assistance. I have also noticed this in the past, so I thought this was a good chance to dig-into it and see if we can improve quoted search term handling.

How Has This Been Tested?

There is pretty extensive unit test coverage for SearchQueryParser. I've added two tests for the new cases and confirmed that over cases still pass. I also have done some smoke-testing when searching for Event Definitions, and it seems to work fine.

Screen Shots

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Refactoring (non-breaking change)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.

[kingzacko1]

LGTM on 6.1