feat: add root query endpoint and POST /.search

[q-uint]

Add GET / and POST /.search to query across all resource types. Introduce RootQueryHandler interface, WithRootQueryHandler server option, ValidateFilterForResourceTypes utility, and a raw Filter field on ListRequestParams. Fix filter validation to include common attributes (id, externalId, meta.*) so filters like meta.lastModified work on per-resource endpoints. Fix potential slice mutation in schema attribute appending.

Summary

• Add GET / and POST /.search endpoints for cross-resource-type queries per RFC 7644 Sections 3.4.2.1 and 3.4.3
• New RootQueryHandler interface and WithRootQueryHandler(h) server option
• New ValidateFilterForResourceTypes utility for narrowing filters to matching resource types
• Add raw Filter string to ListRequestParams for root queries where schema-based validation is not possible
• rawResources() injects id, externalId, and Meta fields (created, lastModified, version) into root query responses
• Extract parsePaginationParams to share count/startIndex logic between root and per-resource handlers
• Bug fix: getFilterValidator and schemaWithCommon now include CommonAttributes() so filters on meta.lastModified, meta.resourceType, id, externalId no longer return 400 on per-resource endpoints
• Bug fix: defensive slice copy in getFilterValidator, ValidateFilterForResourceTypes, and schemaWithCommon to avoid mutating the original schema's backing array