Ability to mark a vulnerability as only impacting certain release artifacts

Hi, @woodruffw suggested I file this here, since the Python vulnerability data uses the osv schema.

I'm one of the maintainers of the popular python `cryptography` package. We ship both source ("sdist") and binary ("wheel") artifacts for all of our releases.

Our binary wheels include a statically linked copy of OpenSSL. This copy may be impacted by upstream OpenSSL security issues.

We'd like to mark our package as impacted by these, so users are aware. _However_, our source packages are _not_ impacted by these, since they don't include a copy of OpenSSL -- they link against the system OpenSSL. If we simply mark a vulnerability as impacting our package, it'll generate false positives for any source users, contributing to alert fatigue.

We'd therefore like some sort of additional metadata to specify that only some artifacts are impacted by a given vulnerability.