[CKC] Add CVE verification with --check-cves option

[bmastbergen]

Adds ability to verify that CVE references in PR commit messages correctly match the upstream commits they reference. Uses the kernel vulnerabilities database to cross-check CVE assignments against upstream commit hashes.

The --check-cves flag enables validation that detects three error conditions: mismatched CVE assignments between PR and upstream commits, CVE references to upstream commits with no CVE assignment, and failures accessing the vulnerabilities database. Output format matches existing checker patterns with support for both plain text and markdown modes.

Here is an example github comment from this code:
ctrliq/kernel-src-tree#616 (comment)

This was written by Claude BTW.

[ciq-it-service-account]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull Request Overview

This pull request adds CVE verification functionality to the kernel commit checker, allowing validation that CVE references in PR commit messages correctly match their upstream counterparts. The change enables cross-referencing with the kernel vulnerabilities database to detect mismatched, missing, or invalid CVE assignments.

Key changes:

• Adds --check-cves flag to enable CVE validation against the vulnerabilities database
• Implements automatic cloning/updating of the kernel vulns repository
• Integrates CVE information into existing bugfix detection output

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Pull Request Overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Pull Request Overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

[nitpick] The docstring example uses CVE-2025-12345 which appears to be a future year. Consider using a more realistic example like CVE-2024-12345 or CVE-2023-12345.

Suggested change

	Only matches 'cve CVE-2025-12345', ignores 'cve-bf' and 'cve-pre' variants."""
	Only matches 'cve CVE-2024-12345', ignores 'cve-bf' and 'cve-pre' variants."""

[bmastbergen]

The future is now copilot! Its 2025!

[Copilot]

Pull Request Overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The regex pattern uses a negative lookbehind (?<!\S) but the docstring mentions it ignores 'cve-bf' and 'cve-pre' variants. The current pattern would still match 'cve CVE-2025-12345' in 'somecve CVE-2025-12345'. Consider using word boundaries \\bcve\\s+ for clearer intent.

Suggested change

	match = re.search(r'(?<!\S)cve\s+(CVE-\d{4}-\d+)', msg, re.IGNORECASE)
	match = re.search(r'\bcve\s+(CVE-\d{4}-\d+)', msg, re.IGNORECASE)