Review the API structure for advisories

[TG1999]

The current API has a lot's of different endpoints that can be combined into one, instead of supporting vulnerabilities can support advisories and group advisories into using heuristics like common identifiers and affected package range.

[TG1999]

Use cases:

• I have a PURL, getting a list of advisories for that PURL
• I have a list of PURLS, and I want list of advisories for all the PURLs

Minimal set of useful data:

For advisory

• TBD

For package

• TBD

Research other APIs like vulnerabilitylookup, osv.dev

The current API mostly looks fine. We will get it reviewed by other consumers

[TG1999]

We will be grouping advisories on basis of content these are the fields summary, severity and packages.

[TG1999]

This is done now

Reference:

• Group related advisories on basis of content #2169

Advisory structure is changed from now

{
"packages": [
            {
                "purl": "pkg:pypi/extractor@0.5",
                "affected_by_vulnerabilities": [
                    {
                        "advisory_id": "pypa_importer_v2/PYSEC-2006-4",
                        "fixed_by_packages": [],
                        "duplicate_advisory_ids": [
                            "pysec_importer_v2/PYSEC-2006-4"
                        ]
                    }
                ],
                "fixing_vulnerabilities": [],
                "next_non_vulnerable_version": null,
                "latest_non_vulnerable_version": null,
                "risk_score": null
            },
],
"advisories_by_id": {
            "pypa_importer_v2/PYSEC-2006-4": {
                "advisory_id": "pypa_importer_v2/PYSEC-2006-4",
                "url": "https://github.com/pypa/advisory-database/blob/main/vulns/extractor/PYSEC-2006-4.yaml",
                "aliases": [
                    "CVE-2006-2458",
                    "GHSA-f836-7jqw-3684"
                ],
                "summary": "Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).",
                "severities": [],
                "weaknesses": [],
}
}