Can the new severity source enum support databases other than NVD & SELF?

The new severity[].source field is great! But I'm finding the limited enumeration of NVD, CNA and SELF values rather limiting; as a downstream database we also often ingest advisories from EUVD and GHSA, each of which may include their own SELF-assessed (I think) severities. (GHSA is particularly interesting as a repository advisory is the package author's attestation while the global GHSA is the database manager's view. They may be different for the same GHSA ID, in fact. But that's a weird quirk of their system and rather aside here)

Could we add EUVD to this field? What about GHSA? And perhaps other advisory prefixes within the OSV ecosystem?

As an example, I could have a JLSEC advisory from an upstream that's a PYSEC- with a CVE- alias. Could I include both NVD's and PYSEC's severity assessments in my JLSEC?

Review the severity.source definition and the existing NVD, CNA, and SELF values first. Resolve whether EUVD, GHSA, PYSEC, and other advisory prefixes belong in the enum, and define how multiple independent severity assessments should be represented; completion requires the schema to validate the agreed cases.