fix(490): Add question mark to escaped chars in TokenEscaper

[shchepinova]

This PR adds question mark ? to the escape characters in TokenEscaper.

The "Expand TokenEscaper to escape ? and | characters" issue also mentions adding the pipe character |, but this will cause TestMultiPrefixTextQuery.test_text_query_returns_both_prefixes, which uses the pipe character as a logical OR in its text search, to fail.

---

Note

Low Risk
Low risk: small regex change to query token escaping plus updated unit tests; potential impact is limited to queries containing ? now matching literally instead of acting as an unescaped special character.

Overview
TokenEscaper now escapes question marks by including ? in both DEFAULT_ESCAPED_CHARS and ESCAPED_CHARS_NO_WILDCARD, and updates the reference link for the escaping rules.

Unit tests are updated to assert ? is escaped in both general text inputs and tag-like values, removing prior TODO expectations.

^{Written by Cursor Bugbot for commit d931c2e. This will update automatically on new commits. Configure here.}

[jit-ci]

Hi, I’m Jit, a friendly security platform designed to help developers build secure applications from day zero with an MVS (Minimal viable security) mindset.

In case there are security findings, they will be communicated to you as a comment inside the PR.

Hope you’ll enjoy using Jit.

Questions? Comments? Want to learn more? Get in touch with us.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

[cursor]

Question mark escaped even when preserving wildcards

Medium Severity

The ? character is a single-character wildcard in Redis (like * is a multi-character wildcard), but it was added to ESCAPED_CHARS_NO_WILDCARD which is the pattern used when preserve_wildcards=True. This pattern intentionally excludes * to preserve wildcard functionality, so ? needs to be excluded from it as well. Currently, LIKE operator queries using ? as a single-character wildcard (e.g., Tag("field") % "patter?") will have the ? escaped, breaking wildcard matching.