bug: soc reports shard failure if _id field starts with hyphen

[petiepooo]

Occasionally, an elasticsearch index's "_id" field may start with a hyphen instead of an alpha/num character. When this happens, an attempt to pivot from Kibana to SOC (2.3.220) fails with an error similar to this:

timestamp=2023-04-13T19:54:07.344820389Z level=warn message="Shard failure" reason="Failed to parse query [(_id:-pAsfIcBPNqvUaZvzIvi) AND NOT _index: ":so-case"]" type=query_shard_exception

Manually adding a quote around the field value allows the query to complete. IE: change the OQL field from _id:-pAsfIcBPNqvUaZvzIvi to _id:"-pAsfIcBPNqvUaZvzIvi" and resubmit.

[dougburks]

Created issue:
#10305