Data quality issue with CVE-2024-11477

**The CVE ID**
https://osv.dev/vulnerability/CVE-2024-11477

**Describe the data quality issue observed**

The record has an `unresolved_ranges` entry for the 7-Zip version range, but the CPE from the CISA ADP container (`cpe:2.3:a:7-zip:7zip:*:*:*:*:*:*:*:*`) is not preserved alongside it.

The source CVE5 record (`https://cveawg.mitre.org/api/cve/CVE-2024-11477`) has both a `versions` array and a `cpes` array in the CISA ADP container. The converter correctly reads `versions` and produces the `unresolved_ranges` entry with `fixed: 24.07`, but drops the `cpes` array.

**Suggested changes to record**

The `unresolved_ranges` entry should include the CPE, consistent with how `CPE_STRING` entries are handled for `:o:` CPEs (as seen in CVE-2019-20477/Fedora):

```json
"unresolved_ranges": [{
"source": "CPE_STRING",
"cpes": ["cpe:2.3:a:7-zip:7zip:*:*:*:*:*:*:*:*"],
"extracted_events": [{"introduced": "0"}, {"fixed": "24.07"}]
}]
```

**Additional context**

Comparing CVE-2019-20477 (PyYAML) reveals three converter behaviors:

1. `:a:` CPE with resolvable range → stored in `affected[].ranges[].database_specific` as `CPE_RANGE`.
2. `:o:` CPE with unresolvable range → stored in `unresolved_ranges` as `CPE_STRING` with CPE preserved.
3. `:a:` CPE with unresolvable range → stored in `unresolved_ranges` with CPE dropped.

The third case is the gap this record hits.

Start by tracing the CVE5 converter path that reads the CISA ADP container, comparing its handling of the versions and cpes arrays. Use CVE-2024-11477 and CVE-2019-20477 as the reference records, and verify that an unresolvable :a: CPE remains in unresolved_ranges alongside the extracted fixed event.

Written by the indexing model from the issue text.