advisory-scan: NVD by CPE, so mattermost and mumble stop scanning as '?'

Two recipes could not see CVEs at all. mattermost-lts has an empty GitHub advisory
feed and renders its security bulletins client-side, so a text sweep finds nothing;
mumble publishes nothing anywhere the registry points. Both returned '?' - nothing
measured - which is honest but useless.

NVD is CPE-indexed and carries structured version ranges, so it answers where the
vendor does not. Declared per recipe as 'nvd-cpe: <image> = <cpe:2.3:...>'.

  mattermost-lts 10.5.0  -> 10.12.4   165 CVEs
  mattermost-lts 10.11.22 -> 10.12.4    0 CVEs  (measured, not unknown)
  mumble         1.3.0   -> 1.6.870      2 CVEs

Both NVD range forms are used: versionEndExcluding is a patched version;
versionEndIncluding means the fix version is unpublished but the upgrade delivers
it whenever it crosses X.

That 0 for the actual mattermost upgrade is the interesting one, and it needed a
new rule to be correct: a fix on the line you upgrade FROM was already yours.
mattermost patches every maintained line at once, so 10.11.22 -> 10.12.4 crosses
10.12.1 while 10.11.22 already had the 10.11.4 backport. Without the rule the scan
claimed 12 CVEs the upgrade did not deliver.

The rule is skipped for placeholders: '7.4.X' parses to a bare 7.4 and would read
as 'already fixed at 7.4', which silently dropped redis CVE-2024-46981 and took
discourse 140 -> 139 before I caught it.

79 tests. discourse 140 / gitea 2 / mailu 2 / keycloak 12 / plausible 6 unchanged.
Fleet sweep: 0 recipes with no usable CVE source, down from 2.

cc-ci-plan/upstream/mattermost-lts.md

@@ -75,3 +75,12 @@
   recreate DB, reimport dump. `DROP DATABASE WITH (FORCE)` requires PostgreSQL 13+ — safe on postgres:15-alpine.
   The previous inline-label approach (no restore hook) was a defect: raw PGDATA restore without a reload
   was a silent no-op. Fixed in PR #2 (restore fix cherry-picked from PR #1 ci/pg-restore).
+
+## NVD CPE fallback
+This project publishes nothing machine-readable we can reach — no GitHub advisory feed,
+no release-attributable changelog — so its CVE count was `?` (nothing measured). NVD is
+CPE-indexed and carries structured version ranges, so it can answer where the vendor
+cannot. It LAGS the vendor, so it is a fallback, never the primary source.
+
+- nvd-cpe: mattermost-team-edition = cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
+- nvd-cpe: postgres = cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

cc-ci-plan/upstream/mumble.md

@@ -19,3 +19,11 @@
 - The server image tag is `v<version>-<build>` (e.g. `v1.6.870-4`); the trailing number is the image
   build, not an app version, and moves independently of upstream releases — `abra recipe upgrade`
   reports "no new versions" for it, so use `resolve-images.py` to see those bumps.
+
+## NVD CPE fallback
+This project publishes nothing machine-readable we can reach — no GitHub advisory feed,
+no release-attributable changelog — so its CVE count was `?` (nothing measured). NVD is
+CPE-indexed and carries structured version ranges, so it can answer where the vendor
+cannot. It LAGS the vendor, so it is a fallback, never the primary source.
+
+- nvd-cpe: mumble-server = cpe:2.3:a:mumble:mumble:*:*:*:*:*:*:*:*