Reporting "is the latest version vulnerable?"

### Current Behavior:

Using jackson-databind 2.9.8 to illustrate

`pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8?type=jar`

With DT 3.4.1, uploading a BOM that contains this component results in the identification of a single threat CVE-2019-12086 (well, single threat as of June 5th 2019)

DT also correctly identifies that the component is outdated and that the latest version is 2.9.9

If one were analyse 2.9.9, one would see that this version has zero threats... ie, no CVE-2019-12086.

The problem/challenge is that:
* DT wont tell you this latter info until a BOM containing jackson-databind 2.9.9 is uploaded
* At such time that 2.9.9 does get analysed, then there is no direct linkage between these "bits of knowledge"

### Proposed Behavior:
1) When a vulnerable component is also outdated AND the latest version is unknown to DT then perform analysis of the latest version. eg OSS Index query for:

`pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8?type=jar`

2) Display "latest version" analysis info on DT vulnerability page (CVE-2019-12086). Note that this provides the opportunity for the sharp-eyed to spot those occasions where the overview/description of the vulnerability does not match up with the OSS Index info.

3) Display a hint when in Audit mode:
* Latest version is vulnerable: Suggest that EXPLOITABLE might be suitable Analysis State
* Latest version is NOT vulnerable: Suggest that UPDATE might be suitable Analysis State ( or 'Remediation Guidance' / 'Risk Response' if/when #357 is implemented).

4) Additional tweaks that would help the above:
* Display latest version icon/info on Project Audit Screen
* Display latest version icon/info on Components Screen (subject to permissions).

Start with the jackson-databind 2.9.8 versus 2.9.9 example and read the existing latest-version detection and OSS Index analysis flows; no implementation files or tests are named. Review the vulnerability page, Project Audit Screen, Components Screen, and related proposal #357. Done means unknown latest versions are analyzed and their vulnerability status informs the requested displays and audit hints, respecting component-screen permissions.

Written by the indexing model from the issue text.