Yarn Berry analyzer does not report vulnerability score

**Describe the bug**
The Yarn Berry analyzer does not report vulnerability scores.
Hence, you cannot automatically fail executions based on CVSS evaluation (`failBuildOnCVSS` parameter).

_This in turn makes vulnerabilities in Yarn Berry projects effectively go unnoticed!_

**Version of dependency-check used**
12.2.2

**To Reproduce**
See the reproducer (for both Yarn versions) at https://github.com/marcelstoer/odc-yarn-berry-reproducer

**Expected behavior**
Running ODC with `failBuildOnCVSS=7` should fail for any NPM package that has vulnerabilities with CVSS scores >=7.

**Preliminary analysis**
AFAIU the issue is in the [YarnAuditAnalyzer.java](https://github.com/dependency-check/DependencyCheck/blob/main/core/src/main/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzer.java) `analyzePackageWithYarnBerry()` → `parseAdvisoryJsons()` sequence.
There is no CVSS score ever extracted or set on the `Advisory` object.
With Yarn Classic we hit the npm audit API directly and get back full advisory data (including numeric CVSS scores).
1. `yarn npm audit --json` emits a text "Severity": "Moderate" field.
2. `parseAdvisoryJsons()` copies that string into `advisory.setSeverity(severity)`. No CVSS number is parsed or stored.
3. The resulting `Advisory` has no numeric score → dependency-check reports it as "Unscored" with severity label "moderate".
4. `-DfailBuildOnCVSS=7` compares against a numeric score that doesn't exist.

Running `yarn npm audit --all --recursive --no-deprecations --json` gives me this (stripped):

```json
{
"value": "uuid",
"children": {
"ID": 1119441,
"Issue": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"URL": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
"Severity": "moderate",
"Vulnerable Versions": "<11.1.1",
"Tree Versions": [
"3.3.2"
],
"Dependents": [
"@ti8m/workbench-widget-loader@workspace:."
]
}
}
```

Tagging @segovia as the original contributor of the Berry analyzer.