Add CVSS scores to Security tab

[djc]

Here's a local implementation.

• The other options on npmjs kinda suck -- not a lot of tests, lack of updates, no CVSS v4

• Quite a bit of complexity, I did a bunch of spot testing but not very comprehensive

Any thoughts? If we move it into a separate module, we could potentially get test vectors from Red Hat, and once it passes those we declare it complete? But, when a new CVSS version comes out, bunch more stuff to add.