tooling: add the OSV CVE information to the official CVE feed

You can find the full context here https://github.com/kubernetes/sig-security/issues/169.

We have the official CVE feed which is pretty well documented:
- https://github.com/kubernetes/sig-security/issues/1
- https://kubernetes.io/docs/reference/issues-security/official-cve-feed/
- https://github.com/kubernetes/sig-security/tree/main/sig-security-tooling/cve-feed

The idea would be to add the OSV information from:
- [ ] https://github.com/kubernetes/sig-security/issues/179
**The new OSV data for new CVEs from the issues**, basically we merged this new tool used by the SRC members to publish the CVE announcement so that it contains a `json osv` JSON blog. See more information to parse the information in the PR: https://github.com/kubernetes/sig-security/pull/171. You can see how the output looks like, it's been recently used on:
- https://github.com/kubernetes/kubernetes/issues/136680
- https://github.com/kubernetes/kubernetes/issues/136677
- https://github.com/kubernetes/kubernetes/issues/136678
- https://github.com/kubernetes/kubernetes/issues/136679
- https://github.com/kubernetes/kubernetes/issues/136789
- [ ] https://github.com/kubernetes/sig-security/issues/178
**The legacy OSV data for the previous CVEs from https://github.com/kubernetes-sigs/cve-feed-osv**, we have this existing database of CVE OSV information that we could enrich the JSON feed with https://github.com/kubernetes-sigs/cve-feed-osv/tree/main/vulns.

Also: on newer CVEs that include a manually written OSV feed from https://github.com/kubernetes-sigs/cve-feed-osv/ should take precedence over the blob in the issues generated by srctl as it might be less precise.

## How to merge the OSV scheme into the JSON feed

Here's my idea, maybe you'll have a better one!

I don't know if there's an official version of a feed of OSV format CVEs, but I think the least invasive change we could do is to add a new custom field in existing the JSON feed. Custom fields are starting with `_`, like the `_kubernetes_io` (based on the JSON feed spec https://www.jsonfeed.org/version/1/) you can see in items in https://kubernetes.io/docs/reference/issues-security/official-cve-feed/index.json.

```json5
{
"_kubernetes_io": {
"feed_refresh_job": "https://testgrid.k8s.io/sig-security-cve-feed#auto-refreshing-official-cve-feed",
"updated_at": "2026-02-06T14:16:51Z"
},
"authors": [
{
"name": "Kubernetes Community",
"url": "https://www.kubernetes.dev"
}
],
"description": "Auto-refreshing official CVE feed for Kubernetes repository",
"feed_url": "https://kubernetes.io/docs/reference/issues-security/official-cve-feed/index.json",
"home_page_url": "https://kubernetes.io",
"items": [
{
"_kubernetes_io": {
"google_group_url": "https://groups.google.com/g/kubernetes-announce/search?q=CVE-2025-15566",
"issue_number": 136789
},
"content_text": "CVSS Rating: [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\n\nA security issue was discovered in ingress-nginx [...] by Jan-Otto Kröpke.\",\n \"type\": \"FINDER\"\n }\n ]\n}\n```\n\n\u003C/details\u003E\n\n\u003C!-- generated by srctl v1.0.0 (2665728667a5-dirty, 2026-01-31T19:18:07Z, go1.25.6) --\u003E\n",
"date_published": "2026-02-06T02:54:24Z",
"external_url": "https://www.cve.org/cverecord?id=CVE-2025-15566",
"id": "CVE-2025-15566",
"status": "fixed",
"summary": "ingress-nginx auth-proxy-set-headers nginx configuration injection",
"url": "https://github.com/kubernetes/kubernetes/issues/136789"
},
// [...]
}
```

So for example, what could be done is to ship the OSV thing under `_kubernetes_io` like:
```json5
{
"_kubernetes_io": {
"google_group_url": "https://groups.google.com/g/kubernetes-announce/search?q=CVE-2025-15566",
"issue_number": 136789
"osv": { // <--- full OSV object inserted here
"schema_version": "1.6.0",
"id": "CVE-2025-15566",
"modified": "2026-02-06T02:46:50Z",
"summary": "ingress-nginx auth-proxy-set-headers nginx configuration injection",
"details": "A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-proxy-set-headers Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Kubernetes",
"name": "ingress-nginx"
},
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "v1.12.5"
},
{
"introduced": "0"
},
{
"fixed": "v1.13.1"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"credits": [
{
"name": "This issue was discoverd **and patched** by Jan-Otto Kröpke.",
"type": "FINDER"
}
]
}
},
"content_text": "CVSS Rating: [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\n\nA security issue was discovered in ingress-nginx [...] by Jan-Otto Kröpke.\",\n \"type\": \"FINDER\"\n }\n ]\n}\n```\n\n\u003C/details\u003E\n\n\u003C!-- generated by srctl v1.0.0 (2665728667a5-dirty, 2026-01-31T19:18:07Z, go1.25.6) --\u003E\n",
"date_published": "2026-02-06T02:54:24Z",
"external_url": "https://www.cve.org/cverecord?id=CVE-2025-15566",
"id": "CVE-2025-15566",
"status": "fixed",
"summary": "ingress-nginx auth-proxy-set-headers nginx configuration injection",
"url": "https://github.com/kubernetes/kubernetes/issues/136789"
}
```

Start in sig-security-tooling/cve-feed and read the official feed documentation, then review issues 178 and 179 plus PR 171 for the legacy and newly generated OSV sources. Trace how the JSON feed is assembled and verify that both OSV sources are represented under the Kubernetes custom field, with manually written data taking precedence.

Written by the indexing model from the issue text.