NVD description version extraction needs improvement

** Vulnerabilities**
[OSV CVE-2022-33967](https://osv.dev/vulnerability/CVE-2022-33967) -- [NVD CVE-2022-33967](https://nvd.nist.gov/vuln/detail/CVE-2022-33967)

[OSV CVE-CVE-2022-30552](https://osv.dev/vulnerability/CVE-2022-30552) -- [NVD CVE-2022-CVE-2022-30552](https://nvd.nist.gov/vuln/detail/CVE-2022-30552)

[OSV CVE-2022-30790](https://osv.dev/vulnerability/CVE-2022-30790) -- [CVE-2022-30790](https://nvd.nist.gov/vuln/detail/CVE-2022-30790)

[OSV CVE-2022-30790](https://osv.dev/vulnerability/CVE-2022-30790) -- [NVD CVE-2022-30790](https://nvd.nist.gov/vuln/detail/CVE-2022-30790)

**Describe the data quality issue observed**
I have seen consistent issues with the conversion of CVEs to OSV in the GIT ecosystem, In the examples I have given we see from NVD a clear definition of "from version X until version Y are affected by this vulnerability" but in OSV, the range start with "commit 0" meaning all version before, leading to a false positive identification.

And in some cases, there is no range given at all in NVD, but the OSV entry still uses "introduced 0" in the ranges.

**Suggested changes to record**
The "introduced" commit needs to correlate to the version in the range given by NVD, assuming we are using NVD as our source, and if we are not, then state from where this assumption comes from.

**Additional context**
i think it might be a bug in the conversion of version tocommits so i will open a bug as well and link it into this issue, just to make sure.