Suppression of specific CVE based on CVSS value

Our implementation of DependencyCheck uses suppression files to 'quiet' issues which are considered not-applicable or low risk, based - in part - on the CVE's CVSS. However, the CVSS ratings are subject to change based on new information or assessment. Our suppression files currently expire, using the 'until' option, resulting in re-analysis on a regular basis.

In addition to time-bounded suppression, we would like to see CVSS-bounded suppression.

While the CVE's CVSS is below client specified threshold, the issues is suppressed.
If CVSS changes to exceed the threshold, the CVSS-bounded suppression fails and the issue is restored to the report.

If both time-bound and CVSS-bound criteria are present, the system would use an 'OR' condition - if either is violated the suppression is no longer valid.

e.g.
CVE-2022-34305 is currently under review (https://nvd.nist.gov/vuln/detail/CVE-2022-34305). We don't currently consider this an issue requiring action - but that may change depending on the outcome of the reanalysis. Our current plans are to review it in November, but, if the risk escalates our plans could change.

The cvss_limit in the example would be our proxy for a risk escalation. With this setup the dependency_check logic would be suppress until 2022-11-01 AND while cvss_limit < 7.0.

```

CVE-2022-34305

```