Design: Foreign Key Relationship for CVE Data Flow

> We should import https://github.com/CVEProject/cvelistV5/ directly and make this the true, correct data source for the CVEs. NVD should be demoted to something entirely secondary.
>
> Also there are data we get that are always keyed by CVE: KEV, EPSS, some CVSS and a few more.
>
> We need a design to flow down these values to an advisory from a CVE record.
>
> Two possible designs come to mind:
>
> 1. Treat CVE special and have a CVE id in an advisory from where to fetch this CVE-level data
> 2. Have an FK relationship to an another advisory (here a CVEproject record) and when this exist collect all the data from there (like EPSS, CVSS, etc) unless they already exist locally (say a RH advisory has a CVSS score of its own, and the CVSS from the "upstream" CVE record does not apply there.)
>

_Originally posted by @pombredanne in [#1015](https://github.com/aboutcode-org/vulnerablecode/issues/1015#issuecomment-3201308929)_

https://drive.google.com/file/d/1LY4qnWw7Ob-Xjakqwc11GTM9aGoCFkDr/view?usp=sharing

@TG1999 @keshav-space Can we start with something simpler like this? Or do I need to handle this in a separate table, RelatedAdvisoryV2? I still don’t fully understand the use of ToDoRelatedAdvisoryV2 can you explain more? and I don’t think we should create a separate advisory for CVEProject.

```
class AdvisoryV2(models.Model):
# ... existing fields ...

cve_advisory = models.ForeignKey(
'self',
on_delete=models.SET_NULL,
null=True,
blank=True,
help_text="Reference to the CVEproject advisory"
)

override_cve_data = models.BooleanField(
default=False,
help_text="When True, local values override any values from the linked CVE advisories"
)

```