feat(osv): add CVSSv4 support in OSV parser

[knqyf263]

Summary

• Add CVSSv4 (CVSS_V4) parsing to the OSV severity parser
• The DB layer already has CvssScoreV40/CvssVectorV40 fields (used by NVD), but the OSV parser only handled CVSS_V3
• Refactor parseSeverity into parseSeverities returning both V3 and V40 results
• Map the new fields to types.VulnerabilityDetail

Verification

Built DB with GHSA data and confirmed CVSSv4 fields are stored:

$ go run ./cmd/trivy-db build --only-update ghsa --cache-dir /tmp/trivy-db-test --output-dir /tmp/trivy-db-out

$ bbolt get /tmp/trivy-db-out/trivy.db vulnerability CVE-2026-21860 | jq .
{
  "Title": "Werkzeug safe_join() allows Windows special device names with compound extensions",
  "Description": "Werkzeug's `safe_join` function allows path segments with Windows device names that have file extensions or trailing spaces.",
  "Severity": "MEDIUM",
  "VendorSeverity": {
    "ghsa": 2
  },
  "CVSS": {
    "ghsa": {
      "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "V3Score": 5.3,
      "V40Score": 6.3
    }
  },
  "References": [
    "https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-21860"
  ]
}

[DmitriyLewen]

LGTM

left one small comment.

Also, I think, it make sense to change the PR title scope from ghsa to osv.

[DmitriyLewen]

nit:
Since you are updating the code in the osv package, I think it would be better to add the tests there as well.

CVSS_V4 is a standard OSV severity type.
This is not unique to GHSA, so other sources will also use these new values.

e.g.:

➜ bbolt get ./trivy.db vulnerability CVE-2025-26625 | jq .CVSS
{
  "bitnami": {
    "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
    "V40Score": 8.6
  },
  "ghsa": {
    "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
    "V40Score": 8.6
  },
  "redhat": {
    "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
    "V3Score": 8.1
  }
}