Fix false positives in CPE matching due to ambiguous vendor/product relations

[nscuro]

Description

Fixes false positives in CPE matching by discarding matches where relations of the vendor and product attributes are ambiguous.

Previously, the following component CPE:

cpe:2.3:a:*:zstandard:1.5.2:*:*:*:*:*:*:*

was getting matched with the following CVE CPEs:

cpe:2.3:h:amd:*:*:*:*:*:*:*:*:*
cpe:2.3:a:pascom_cloud_phone_system:*:*:*:*:*:*:*:*:*
cpe:2.3:h:intel:*:*:*:*:*:*:*:*:*

Due to the vendor comparison yielding a SUBSET, and the product comparison yielding a SUPERSET relation. Both SUBSET and SUPERSET on their own can be considered a match, but in combination they can cause ambiguities like above.

Addressed Issue

Fixes #3178

Additional Details

Depends on stevespringett/CPE-Parser#181

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have added corresponding update logic
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

[Jasper-Ben]

LGTM :)