[ECR] [request]: Include RL metric into CVSS*_VECTOR details

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Current format of scan report contains CVSS2_VECTOR for each CVE and doesn't provide details on fixed version.
However Clair has that info under fixed_in_version.
It would be beneficial to have the Remediation Level (RL) metric, so users can filter results and count only those that can be fixed.

**Which service(s) is this request for?**
ECR, Image scanning.

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
With current scan report format we can only see the severity and affected package, but no details on the fixed version.
Each CVE should be validated in that case using some custom tool/mechanism to see if we have a fix. We are loosing in that case important details that Clair provides and do a double work instead of parsing the report in ECR.

**Are you currently working around this issue?**
As for today we are using different tools to validate report results which makes the ECR scan feature less suitable.

**Additional context**
Anything else we should know?

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)