feat: add average_severity to PurlStatus

[jcrossley3]

Fixes: #1099

[carlosthe19916]

Thanks for the enhancement. It works as expected.

Only one thing I noticed is that the "average_severity" is outside the "vulnerability" object. while in other endpoints the "average_severity|severity" is part of the "vulnerability" object itself (next to the "identifier" field). But the current response is more than enough for me :)

{
    "advisories": [
            {                
                "status": [
                    {
                        "vulnerability": {
                            "identifier": "CVE-2023-28867"                            
                        },
                        "average_severity": "high",
                        "status": "not_affected"
                    }
                ]
            }
    ]
}

[jcrossley3]

I agree it's weird, but it was the least invasive solution, because that vulnerability object is re-used in other places that don't return severity. Because there is a cost to calculating severity, I didn't want to add it in all those other places.

One trivial alternative is to "flatten" the structure, removing the vulnerability name and promoting its fields one level up, like so:

{
    "advisories": [
            {                
                "status": [
                    {
                        "identifier": "CVE-2023-28867"            
                        ...                
                        "average_severity": "high",
                        "status": "not_affected"
                    }
                ]
            }
    ]
}

Would that be better?

[carlosthe19916]

Let's leave it as it is (I approved this PR already as it is) :)

Both options works fine technically (the current code and what you suggested). My comment was more on aesthetics

[jcrossley3]

Ok, but I'm now thinking that it might be ok to add severity/score to that object everywhere it's used. It seems that, after this change, all but one place return the severity/score with the object, so I think we can safely just add those fields to it.

I'll do that in a separate PR, though.