The war against al-Qaeda is over, but continuing to fight terrorism will require understanding what we did that worked - and what didn't