`@querystring-search` does not handle Virtual Host Monster (VHM) mapped paths

[erral]

The /@querystring-search endpoint fails to return results when queried with paths relative to a virtual host root. While the standard /@search endpoint correctly resolves virtual paths to physical catalog paths using the VirtualRootPhysicalPath request variable, /@querystring-search passes the criteria directly to the query builder without normalization.

This causes modern frontend components (like the new Svelte-based pat-filemanager) to show empty listings when navigating into subfolders in a production environment where VHM is active.

Steps to Reproduce

1. Set up a Plone site behind a Virtual Host Monster (e.g., mapping http://plone.org/ to /Plone).
2. Create a folder at /Plone/folder.
3. Call /@querystring-search via the virtual URL http://plone.org/@querystring-search with the following JSON:

   {
     "query": [
       {
         "i": "path",
         "o": "plone.app.querystring.operation.string.path",
         "v": "/folder::1"
       }
     ]
   }

4. Expected: The endpoint returns the children of /Plone/folder.
5. Actual: The endpoint returns 0 results because it looks for a physical path /folder, which does not exist in the catalog.

Technical Details

The issue lies in plone.restapi.services.querystringsearch.get.QuerystringSearch. Unlike plone.restapi.search.handler.SearchHandler, it does not check for VirtualRootPhysicalPath in the request.
In SearchHandler._constrain_query_by_path, the following logic is applied:

vhm_physical_path = self.request.get("VirtualRootPhysicalPath")
if vhm_physical_path:
    # ... prepends vhm_physical_path to the query ...

The @querystring-search implementation should adopt similar logic to ensure consistency across search services.

Proposed Solution

Update QuerystringSearch.__call__ in src/plone/restapi/services/querystringsearch/get.py to:

1. Detect VirtualRootPhysicalPath.
2. Iterate through query criteria.
3. For any path index, prepend the physical root to the value (handling both string and list formats).
4. Preserve the ::depth suffix if present in the string value.

[davisagli]

I don't understand what the virtual hosting has to do with this.

From what I see in plone.app.querystring, this operation uses the _navigationPath parser, which expects a path relative to the navigation root: https://github.com/plone/plone.app.querystring/blob/2c72ef189180cf2bba3b219a0be6cdbc88954ff1/src/plone/app/querystring/queryparser.py#L394

If the path does not already start with the physical path of the navigation root object, it is prepended: https://github.com/plone/plone.app.querystring/blob/2c72ef189180cf2bba3b219a0be6cdbc88954ff1/src/plone/app/querystring/queryparser.py#L374

That ought to work regardless of what virtual hosting is used for the request. So where does it go wrong?