Expose CPE and CVSS vector for NEW_VULNERABILITY notification

### Current Behavior

When creating a template for creating JIRA tickets for new vulnerabilities using the NEW_VULNERABILITY notification, it appears that not all available information about either the vulnerability itself nor the affected component are exposed in the JSON payload.
In particular I'm missing the CPE of the affected component (PURL is available, but not useful to me) and the CVSS(v3) vector of the vulnerability (again, v2 and v3 scores are available, but not enough for my use case).

### Proposed Behavior

In the notification JSON payload, expose CPE of the affected component as subject.component.cpe and the CVSS vector(s) as subject.vulnerability.cvssv2vector and subject.vulnerability.cvssv3vector.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested