feat: RHEL CSAF provider

[willmurphyscode]

Add a new provider, rhel_csaf, that downloads rhel vulnerability data from the CSAF VEX JSON that RedHat publishes. Move the existing rhel provider to rhel_legacy. Add a top-level rhel provider that can be configured to delegate to rhel_legacy or rhel_csaf. Add some dataclasses to deserialize CSAF JSON into.

Fixes #323

• - pass down configs and logging
• - unit tests for uber provider
• - unit tests for csaf provider
• - unit tests for transformer
• - test and handle not-fixed vs won't-fix
• - tweak quality gate
• - README explaining how new provider works
• - chase down WARN unable to merge matches ... from grype
• - figure out about incremental updates and skip_if_exists
• - handle cvss v2 scores
• - better way to tweak quality gate

[willmurphyscode]

Looks like this failed with no space left on device: https://github.com/anchore/vunnel/actions/runs/12682455877/job/35347881901?pr=758#step:4:1848

[wagoodman]

re: no space, you can use runs-on: ubuntu-22.04-4core-16gb both

vunnel/.github/workflows/pr-quality-gate.yaml

Line 42 in 697e8a2

runs-on: ubuntu-22.04

and

vunnel/.github/workflows/nightly-quality-gate.yaml

Line 36 in 697e8a2

runs-on: ubuntu-22.04

[willmurphyscode]

This is probably wrong. Why not None?

[willmurphyscode]

We really don't want to do this. We need to investigate the particular false positive in the quality gate:

   grype[custom-db]@v0.86.1-14-g67ac96f ONLY  mariadb-common@3:10.3.28-1.module_el8.3.0+757+d382997d      CVE-2021-27928  FalsePositive  (this is a new FP 😱)
   grype[custom-db]@v0.86.1-14-g67ac96f ONLY  mariadb@3:10.3.28-1.module_el8.3.0+757+d382997d             CVE-2021-27928  FalsePositive  (this is a new FP 😱)

I think we should investigate fixing grype's version comparison so that RPM version 3:10.3.28-1.module_el8.3.0+757+d382997d compares as equal to 3:10.3.28-1.module+el8.3.0+10472+7adc332a rather than less. Then neither reference nor candidate will find this CVE.

Specifically https://github.com/anchore/grype/blob/ed98490e966cf215eb785395fe80b79f99e420fa/grype/version/rpm_version.go#L99-L105

This needs to be smarter to understand that centOS and RedHat build numbers are not comparable, so 1.module+el8.3.0 and not 1.module+el8.3.0+10472+7adc332a is the string being compared. Probably a new compareRelease function instead of calling compareVersion again.