Add machine-readable "unmaintained" status to schema

Problem

When a package becomes unmaintained, it's important to notify downstream users so they can migrate, since future vulnerabilities won't be patched.

Some ecosystems are already publishing these notices via OSV (e.g., RUSTSEC-2026-0173). However, there is no machine-readable field to distinguish an "unmaintained" notice from a standard vulnerability. Tools currently have to resort to brittle string parsing of the details or summary text.

Programmatic distinction is necessary because an unmaintained package requires a completely different remediation workflow (e.g., finding an alternative or forking) compared to a typical version bump for a standard vulnerability (also is not as urgent as an immediately exploitable vulnerability).

Proposal

Introduce a standardized, machine-readable way to flag an advisory as an unmaintained notice.

One approach would be adding a new severity type, as that field allows multiple different types:
https://ossf.github.io/osv-schema/#severitytype-field

"severity": [
  {
    "type": "MAINTENANCE",
    "score": "UNMAINTAINED"
  }
]

Open to other options as well!

@SecurityCRob and @kborchers I believe this had been an discussion point in some other openssf meetings, let me know if I covered the problem here or if I missed something, and if you guys have any other suggestions!

Start by reviewing the OSV schema's severitytype field and the linked severity-type documentation. Compare the proposed MAINTENANCE/UNMAINTAINED representation with the schema's existing conventions, then document the chosen machine-readable representation and its validation impact. Done means the schema has an agreed, standardized unmaintained status that downstream tools can distinguish.