feat(CVSSv4): Add support for CVSSv4 to cve-bin-tool

[JigyasuRajput]

Add CVSSv4 Support to CVE Binary Tool

Fixes #4238

Description

This PR introduces support for CVSS version 4.0, the latest iteration of the Common Vulnerability Scoring System. With NVD now including CVSSv4 data, this update ensures the tool uses the most accurate and up-to-date severity metrics for vulnerability assessments.

Key Changes

• Core Functionality

  • Added CVSSv4 parsing from NVD JSON feeds (baseMetricV4 and cvssMetricV4)
  • Updated database schema to store CVSSv4 metrics
  • Prioritized CVSSv4 scores over v3/v2 when available
  • Enhanced vector string validation for CVSSv4 format

• Testing

  • Added comprehensive unit and integration tests for CVSSv4 parsing, database insertion, and scanner prioritization
  • Verified backward compatibility with existing CVSSv3/v2 data

Verification Steps

1. Run the tool against CVEs with CVSSv4 data (e.g., recent vulnerabilities from NVD).
2. Verify CVSSv4 scores and vectors appear in reports, dashboards, and VEX outputs.
3. Check the database for CVSS_4 metric entries.

---

Future Work

updating the docs for this feature is required, I'll create an issue for the same

[JigyasuRajput]

resolved the merge conflict here

[terriko]

I only did a quick read through this so I could justify enabling the CI, but one little typo to fix now. I'll come back to do a more careful review after the tests run so I have more data about how long things take, but this looks promising.

[JigyasuRajput]

I've fixed the test which was causing problem, also resolved the merge conflict.

[terriko]

I've re-enabled the CI tests, and I've flagged @mastersans and @anthonyharrison for review, since both of them have touched this stuff more recently than I have.

[terriko]

You've got a failing test:

 FAILED test/test_cvedb.py::TestCVEDB::test_new_database_schema - AssertionError: CVSS v4 metric name is not correct
assert 'CVSS-4' == 'CVSS_4'
  
  - CVSS_4
  ?     ^
  + CVSS-4
  ?     ^
======= 1 failed, 31 passed, 4 skipped, 4 warnings in 296.51s (0:04:56) ========

Probably we want all the identifiers to use either - or _ but I don't think it much matters which one we use and why you made just the one different, so I'll leave that to you to look at.

[terriko]

marking as needing changes again because I clicked the wrong button a second ago, sorry for the noise!

[JigyasuRajput]

I need to take a look at this, I committed the suggestions directly from GUI here. Most likely the tests would fail (forgot to put a comment after committing)

[JigyasuRajput]

the tests also needed update to use "CVSS-4", It should be working fine now