Describe the bug
Unquoted leading / must be escaped in KQL, since this is used for regex syntax with lucene

This

process.args:/lockscreenurl\:http*

should become

`"\\/lockscreenurl\\:http*"`

to mimic expected DSL conversion

but instead it is converted to

`"/lockscreenurl\\:http*"`

To Reproduce
Steps to reproduce the behavior:

1. search process.args:/lockscreenurl\:http* in kibana
2. this is converted to: "\\/lockscreenurl\\:http*"
3. run kql.to_dsl("process.args:/lockscreenurl\:http*")
   4 compare diffs