Collect Spring vulnerabilities upstream directly

Based on these reports we must collect advisories directly from Spring:
- https://github.com/aboutcode-org/vulnerablecode/issues/1842
- https://github.com/aboutcode-org/vulnerablecode/issues/1841

For https://public.vulnerablecode.io/vulnerabilities/VCID-2k6t-8wyh-gufq the page at https://spring.io/security/cve-2025-22228 has the data, but as of today, https://nvd.nist.gov/vuln/detail/CVE-2025-22228 is way behind and is missing details "AWAITING ANALYSIS"

The spring data is available:
1. Upstream
- in a semi structured Atom feed at https://spring.io/security.atom
- in HTML index pages at https://spring.io/security
- in HTML pages like at https://spring.io/security/cve-2025-22228 and in semi-structure JSON at https://spring.io/page-data/security/cve-2025-22228/page-data.json
- in a semi-structured JSON at https://spring.io/page-data/security/page-data.json and next pages as https://spring.io/page-data/security/page-2/page-data.json

2. Downstream
- in the CVE.org proper at https://cveawg.mitre.org/api/cve/CVE-2025-22228 and https://github.com/CVEProject/cvelist/blob/eb8ad67fb2f6b6907952fe9b34bd6de97936ff36/2025/22xxx/CVE-2025-22228.json#L6 which is the Spring published record
- in CISA vulnrichment https://github.com/cisagov/vulnrichment/blob/e8aca7e9e108cbaa24c0cdfddd2c98be95521e62/2025/22xxx/CVE-2025-22228.json#L12 which is essentially the same
- From there it has also been processed by GH at https://github.com/advisories/GHSA-mg83-c7gq-rv5c and Gitlab and other places . The GH record has the most data with detailed commit and versions

Note that https://repo1.maven.org/maven2/org/springframework/security/spring-security-crypto/ does not have all the versions publicly available (like 5.7.15 and 5.7.16) as they are only available under commercial maintenance contract. We need to account for these "ghosts" but real versions