Add CVSS metadata to advisories

[djc]

It appears tools like Snyk keep track of CVSS data. It would be nice if we could provide that for Rust code, too.

[tarcieri]

It's already supported via the cvss crate. Here's example usage in an advisory:

https://github.com/RustSec/advisory-db/blob/master/rust/std/CVE-2018-1000810.toml#L8

However, it looks like it never got added to the advisory template.

[djc]

Right, and therefore not many advisories actually have it.

[tarcieri]

It's also somewhat arcane to compute and therefore not something I'd want to block collection of advisories on, but rather something I'd like for curators to add retroactively.

[tarcieri]

I'll consider this mostly addressed by #250, but change the title to reflect that it'd still be nice if curators were to submit CVSS information retroactively.

[pinkforest]

There isn't anything actionable here but I guess we are fishing for ideas how to retroactively collect this data.

Now that we have discussions -

I started a concrete discussion favor of this here:
#1350

Closing this as completed