nvd-cve-osv: OpenSSL versions do not normalize correctly

[OpenSSL's versions](https://wiki.openssl.org/index.php/Versioning) aren't being normalized very well, by the [Go code](https://github.com/google/osv.dev/blob/0d63403cba8bbb76055fd7791c4b5367c37fcac9/vulnfeeds/cves/versions.go#L967) or the [Python code](https://github.com/google/osv.dev/blob/0d63403cba8bbb76055fd7791c4b5367c37fcac9/osv/bug.py#L35) (unsurprising, given they're supposed to behave the same):

`OpenSSL_1_1_1w` winds up getting normalized to `1-1-1` and when there's `OpenSSL_1_1_1a` to `OpenSSL_1_1_1w` (as well as `OpenSSL_1_1_1`) they're all overwriting each other during normalization and the last one wins.

_Originally posted by @andrewpollock in https://github.com/google/osv.dev/issues/1984#issuecomment-2063036937_