Allow recording an overridden severity level for an advisory

[raboof]

As encountered in the example of #22, there might be situations where we disagree with the severity rating provided with an advisory (in this case: the CVSS score of MEDIUM). As CVSS can be restrictive in how it assigns severity ratings, we might want to introduce a text-based severity rating of our own (like low/moderate/important/critical).

For the API, it would be sufficient to encode this as simple advisory id, severity pairs, as in the vast majority of cases an advisory will have the same severity regardless of the version of the affected package. This keeps the data volume of the information to be shared low.

An example would be: CVE-2023-38253 low.

Since this can be so compact the online tracker could provide all this data as a single bulk endpoint, so instead of having to do many requests the local tool can just get all overridden severities in a single request and cache that knowledge.

[fricklerhandwerk]

Discussed with @raboof

Request:

GET /api/v1/issues/by_cve?cve=CVE-1234-12345&cve=CVE-1234-12346

Note

URL length is 8KB by default. GET bodies are non-standard. POST doesn't seem right.

Response returns all issues that have status other than UNKNOWN:

[
  {
    "id": "NIXPKGS-1234-12345",
    "cve": [ "CVE-1234-12345", "CVE-4321-54321" ],
    "status": "WONTFIX",
  },
  {
    "id": "NIXPKGS-1234-12346",
    "cve": [ "CVE-1234-12346", "CVE-4321-54328" ],
    "status": "WONTFIX",
  }
]

[fricklerhandwerk]

Nix-Security-WG/nix-security-tracker#121

[raboof]

Implemented in the local scanner in Nix-Security-WG/nix-security-tracker#125 🎉