Add new Apache CVE data source

There is new 'raw' public data from Apache:
- an index at https://cveprocess.apache.org/publicjson
- individual vulnerabilities at e.g., https://cveprocess.apache.org/publicjson/CVE-2020-17513

The detail files are in CVE-json v4.0 or v5.0 format depending on when they were created.

There is likely some interest upstream and value to refine these further for specific projects such as https://security.apache.org/projects/kafka/ , possibly normalized to the latest CVE-json 5.0 and perhaps other formats such as OSV, and cleaning up the data quality (especially the version range conversions Mitre has been doing seem messy, or misleading at first would be good to fix)