advisory-scan: NVD by CPE, so mattermost and mumble stop scanning as '?'

Two recipes could not see CVEs at all. mattermost-lts has an empty GitHub advisory
feed and renders its security bulletins client-side, so a text sweep finds nothing;
mumble publishes nothing anywhere the registry points. Both returned '?' - nothing
measured - which is honest but useless.

NVD is CPE-indexed and carries structured version ranges, so it answers where the
vendor does not. Declared per recipe as 'nvd-cpe: <image> = <cpe:2.3:...>'.

  mattermost-lts 10.5.0  -> 10.12.4   165 CVEs
  mattermost-lts 10.11.22 -> 10.12.4    0 CVEs  (measured, not unknown)
  mumble         1.3.0   -> 1.6.870      2 CVEs

Both NVD range forms are used: versionEndExcluding is a patched version;
versionEndIncluding means the fix version is unpublished but the upgrade delivers
it whenever it crosses X.

That 0 for the actual mattermost upgrade is the interesting one, and it needed a
new rule to be correct: a fix on the line you upgrade FROM was already yours.
mattermost patches every maintained line at once, so 10.11.22 -> 10.12.4 crosses
10.12.1 while 10.11.22 already had the 10.11.4 backport. Without the rule the scan
claimed 12 CVEs the upgrade did not deliver.

The rule is skipped for placeholders: '7.4.X' parses to a bare 7.4 and would read
as 'already fixed at 7.4', which silently dropped redis CVE-2024-46981 and took
discourse 140 -> 139 before I caught it.

79 tests. discourse 140 / gitea 2 / mailu 2 / keycloak 12 / plausible 6 unchanged.
Fleet sweep: 0 recipes with no usable CVE source, down from 2.

cc-ci-plan/audit-sources.py

@@ -127,6 +127,15 @@ def security_source_audit(recipe: str) -> list[dict]:
     """
     urls, _ = _registry_urls(recipe)
     out = []
+    # NVD CPE entries are a first-class source: for projects publishing nothing machine-readable
+    # (mattermost, mumble) they are the ONLY structured source, and omitting them here made two
+    # recipes look permanently blind after they had been fixed.
+    for key, cpe in A.registry_cpes(recipe, REGISTRY_DIR):
+        e = A.nvd_advisories(cpe, key)
+        n = len(e.get("advisories") or [])
+        out.append({"source": e["source"] + f"  ({cpe.split(':')[4]}/{cpe.split(':')[3]})",
+                    "kind": "advisory-feed" if n else "no-cve-data",
+                    "status": e["status"], "cves": n, "usable": n})
     for entry in A.github_advisories(urls):
         out.append({"source": entry["source"], "kind": "advisory-feed",
                     "status": entry["status"], "cves": len(entry.get("advisories") or []),