Add bottlerocket advisories

AWS uses Bottlerocket, a Linux distro for containers
- https://bottlerocket.dev/
- https://aws.amazon.com/bottlerocket/
- https://github.com/bottlerocket-os

Based on:
- https://github.com/bottlerocket-os/bottlerocket-project-website/blob/8ed231c2e98619c22db2bbd85d01b558df18eb26/content/en/os/1.34.x/concepts/variants/index.markdown#security-advisories
- https://bottlerocket.dev/en/os/1.34.x/concepts/variants/#software-inventory-and-security-advisories

> Security Advisories
> Bottlerocket publishes security advisories on the repo’s GitHub’s Security tab and a gzipped updateinfo.xml file at advisories.bottlerocket.aws (make sure you follow redirects: e.g. use curl -LO https://advisories.bottlerocket.aws/updateinfo.xml.gz).

See also this discussion thread by @ginglis13 :
- https://github.com/bottlerocket-os/bottlerocket/discussions/4063

Therefore, sources are:
- https://github.com/bottlerocket-os/bottlerocket/security
- https://advisories.bottlerocket.aws/updateinfo.xml.gz

The purl for this distro is unclear in particular:
- https://bottlerocket.dev/en/os/1.34.x/concepts/variants/#software-inventory-and-security-advisories

> Software inventory and security advisories

> Since Bottlerocket doesn’t use a package manager, keeping track of the software delivered as part of a variant is a little different. Additionally, the concept of a ‘package’ is only relevant as a part of the build process. In the course of running Bottlerocket, you probably want to keep track of what specific software and versions you are using as well as understand how this software relates to known vulnerabilities.
Note

> The best patching strategy for Bottlerocket is to always update to the most recent release. Since packages are only used at build-time and the packages cannot mutate, the inventory will never change for a given version and variant. Updating to the most recent version will patch all packages.

> Bottlerocket provides information to both understand the software included in a variant and how it connects to published security advisories.

The packages are likely sourced from `updates.bottlerocket.aws` ... details are TBD