Allow perform OWASP Risk Rating and CVSS in the Component's CVE Audit

### Current Behavior

Currently the CVE audit allows only CVE impact assessment as an analysis state, justification, vendor response, details and comments.

But the CVE official CVSS may not be same for all environments and sometime totally differs to that we use in our project. E.g. Vulnerability affects only Windows systems but we use Linux.
Or it is calculated for standard Linux desktop system and we use Linux embedded and very limited system.
So we need to have project/product specific CVSS and OWASP Risks calculations for CVEs.

### Proposed Behavior

It could be very good to have in the CVE Audit the project/component own CVSS calculator and OWASP Risk Rating so we can exact describe all risks and recalculate CVSS based on really used environment and project configuration.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Start by reviewing the Component's CVE Audit and its existing impact-assessment fields; no implementation files or tests are named. Clarify how project/component-specific CVSS and OWASP Risk Rating calculations should coexist with official scores before implementing. Done means the audit supports both assessments using the project's actual environment and configuration.

Written by the indexing model from the issue text.