Use github advisories as a source instead of NVD

Hi

There are lots of false positives in Dependency check because of the data pulled from NVD. I have been querying NVD database and it is a nightmare to try to flag a vulnerability against a given library and version, i think this is the root cause for the false positives.

My recommendation is to use github advisories as the database source (if the license of the database allows you to do that). This data is much more clean and reliable and i think false positives will disappear, making this a much better tool.

Thanks