feat(detector/vuls2): surface MSRC exploitability under Optional["exploit"]

vuls-data-update now extracts the advisory-level MSRC exploitability
assessment ("Publicly Disclosed:...;Exploited:...;Latest Software
Release:...;...") as the CVRF vulnerability's "exploitability" optional value.
Map it into CveContent.Optional["exploit"], mirroring the legacy gost
Microsoft path (gost/microsoft.go), which surfaced cve.ExploitStatus — the
same assessment string — under the same Optional["exploit"] key.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: MaineK00n

detector/vuls2/vuls2.go

@@ -852,7 +852,18 @@ func walkVulnerabilityDatas(m map[source]sourceData, vds []detectTypes.Vulnerabi
 										}
 										return time.Date(1000, time.January, 1, 0, 0, 0, 0, time.UTC)
 									}(),
-									Optional: map[string]string{"vuls2-sources": string(bs)},
+									Optional: func() map[string]string {
+										m := map[string]string{"vuls2-sources": string(bs)}
+										// Mirror the legacy gost Microsoft handling, which
+										// surfaced the MSRC exploitability assessment
+										// ("Publicly Disclosed:...;Exploited:...;...") under
+										// Optional["exploit"]. vuls-data-update extracts it as
+										// the advisory-level "exploitability" optional value.
+										if e, ok := v.Content.Optional["exploitability"].(string); ok && e != "" {
+											m["exploit"] = e
+										}
+										return m
+									}(),
 								}),
 							}, nil
 						}()

detector/vuls2/vuls2_test.go

@@ -8810,6 +8810,7 @@ func Test_postConvert(t *testing.T) {
 															},
 														},
 														Published: new(time.Date(2025, 5, 13, 0, 0, 0, 0, time.UTC)),
+														Optional:  map[string]any{"exploitability": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"},
 													},
 													Segments: []segmentTypes.Segment{
 														{
@@ -8878,7 +8879,10 @@ func Test_postConvert(t *testing.T) {
 								SourceLink:    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21234",
 								Published:     time.Date(2025, 5, 13, 0, 0, 0, 0, time.UTC),
 								LastModified:  time.Date(1000, time.January, 1, 0, 0, 0, 0, time.UTC),
-								Optional:      map[string]string{"vuls2-sources": `[{"root_id":"CVE-2025-21234","source_id":"microsoft-cvrf","segment":{"ecosystem":"microsoft"}}]`},
+								Optional: map[string]string{
+									"exploit":       "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely",
+									"vuls2-sources": `[{"root_id":"CVE-2025-21234","source_id":"microsoft-cvrf","segment":{"ecosystem":"microsoft"}}]`,
+								},
 							},
 						},
 					},