Update the existing importers to use the reference type

issue: https://github.com/nexB/vulnerablecode/issues/1487
related pull request: https://github.com/nexB/vulnerablecode/pull/1518

The importer list that required an update:

- [ ] nvd,
- [ ] github
- [ ] gitlab
- [ ] npm
- [ ] pypa
- [ ] nginx
- [ ] pysec
- [ ] alpine_linux
- [ ] openssl
- [ ] redhat
- [ ] debian
- [ ] postgresql
- [ ] archlinux
- [ ] ubuntu
- [ ] debian_oval
- [ ] retiredotnet
- [ ] apache_httpd
- [ ] mozilla
- [ ] gentoo
- [ ] istio
- [ ] project_kb_msr2019
- [ ] suse_scores
- [ ] elixir_security
- [ ] apache_tomcat
- [ ] xen
- [ ] ubuntu_usn
- [ ] fireeye
- [ ] apache_kafka
- [ ] oss_fuzz
- [ ] ruby
- [ ] github_osv