fix(vuln-id): cap autodetected vulnerability_id_type at column width (20)

resolve_vulnerability_id_type returned the raw uppercased prefix with no
length bound, but vulnerability_id_type is CharField(max_length=20) while
vulnerability_id is unbounded text. A >20-char prefix (e.g. a dash-less
token/hash used as an id) raised DataError on save()/bulk_create (import
500) and was silently truncated by the 0277 backfill's bulk_update CAST.
Treat an over-length prefix as untyped (None) so save, bulk_create, and
the backfill all agree and never error or truncate.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Maffooch

dojo/finding/vulnerability_id.py

@@ -8,10 +8,14 @@ def resolve_vulnerability_id_type(vulnerability_id: str | None) -> str | None:
     Structural, no registry: ``CVE-2024-1 -> "CVE"``, ``GHSA-... -> "GHSA"``,
     ``RUSTSEC-2021-0001 -> "RUSTSEC"``, ``ALINUX2-SA-... -> "ALINUX2"``. Returns the uppercased
     prefix, or ``None`` when there is no non-numeric prefix (bare numbers / UUIDs / no dash).
+
+    The prefix is capped at the ``vulnerability_id_type`` column width (20). A longer prefix is
+    not a real scheme (e.g. a dash-less hash used as an id), so it is treated as untyped rather
+    than truncated/erroring on save, bulk_create, and the 0277 backfill.
     """
     if not vulnerability_id:
         return None
     prefix = str(vulnerability_id).strip().split("-", 1)[0].strip()
-    if not prefix or prefix.isdigit():
+    if not prefix or prefix.isdigit() or len(prefix) > 20:
         return None
     return prefix.upper()