Easier way to connect between OSV advisories and other metadata (e.g. CWEs, CVSS, EPSS, CISA KEV)

CWEs, CVSS, EPSS, CISA KEV are interesting metadata that users of the OSV.dev feed might be interested in.

Today, OSV.dev aggregates feeds from different sources out of our control, which may or may not include these metadata. Some of this metadata may not make sense to include at all for a specific home database. e.g. EPSS, which comes from a single authoritative entity [first.org] rather than the home database (e.g. Debian Security Advisories).

We should explore an easier way for users of OSV.dev to aggregate and collect this metadata for advisories. For example, most of our advisories are linked to a CVE ID, from which we could:

- Consult the NVD / CVE List for CVSS, CWE
- Consult the first.org EPSS data
- Consult the CISA KEV

Some possibilities (that are not mutually exclusive):

# Via a new API
`https://api.osv.dev/v1/external_metadata/` which would should work using any ID alias (e.g. GHSA, DSA), and return something lke:

```
{
"aliases": ["CVE-1234", "GHSA-1234", "DSA-1234"],
"cvss": [
{"source": "nvd.nist.gov", "value": "..."}
],
"cwe": [
{"source": "nvd.nist.gov", "value": "..."}
],
"epss": [
{"source": "first.org", "value", "..."}
],
"kev": [
{"source": "cisa.gov", "value": true/false}
]
}
```

# Via data dumps

We could provide this same data via our data dumps,

```
gs://osv-vulnerabilities/external_metadata/CVE-1234.json
```

which would contain the same JSON as the API.