Add support for advisories defined in CSAF

### Current Behavior

Some commercial software vendors provide advisory information in CSAF 2.0 format. These include RedHat and Oracle, among others. There isn't currently a good way to identify vulnerabilities in a specific part of RHEL for example, as CPE isn't granular enough.

Support for CSAF was brought up in https://github.com/DependencyTrack/dependency-track/issues/1374#issuecomment-1065265818

### Proposed Behavior

Add native support for consuming CSAF 2.0 feeds. This should be definable by Dependency-Track administrator, similar to how package repositories are managed today.

Concerns:
* There is a lack of tooling and libraries that support CSAF today
* We need a reusable Java library that works universally across any vendor that provides CSAF, and not specific to how certain vendors have implemented CSAF
* Support for CSAF profile 1, 2, and 4 are likely required. Support for profile 3 is likely optional
* Chosen library should include support for resolving CSAF feeds according to spec, including `/.well-known/csaf/provider-metadata.json`, `ROLIE`, `security.txt`, and `csaf.data.security.domain.tld`. CSAF resolution via the specs distribution requirements should be the responsibility of the library, not Dependency-Track
* There are no guidelines for how to resolve products in a product tree
* There doesn't seem to be a universally accepted way to associate a component in an SBOM to a product in a CSAF advisory

Notes:
* Support for CSAF is for advisories only. It is likely not possible to support CSAF VEX (profile 5) without much more guidance from OASIS.
* Upon release, this should likely be a beta feature. CSAF is new, has limited adoption, and the correlation to component identity in SBOMs has likely not been tested in the real world. There will likely be compatibility issues, thus beta feature with associated warning is recommended

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested