Provide a recommendation for unclear vendor names

[tschmidtb51]

As discussed in TC meeting 2025-11-26, the TC should discuss which guidance we provide for the case, if the vendor name is not clear or even unknown.
We should consider that from a matching, writing and also from a parsing point of view.

Split up from #1215.

[tschmidtb51]

Current suggestions include:

• doing a little digging (OSINT):
  • vendor CSAFs (how do they call themselves)
  • vendor SBOMs
  • vendor security advisories
  • vendor VEX
  • vendor imprint
  • vendor privacy
  • vendor website
• cpe vendor name (if CPE is officially assigned by the vendor)
• using the repo org name
• commonly referred to by others