rustsec_refs_imported() could possibly panic on short or malformed rustsec.org URLs

Summary

I see hardcoded byte-range slice [31..48] usage in the function rustsec_refs_imported()

rustsec/src/osv/advisory.rs

    /// Try to extract RustSec alias id from OSV advisory metadata
    pub fn rustsec_refs_imported(&self) -> Vec<Id> {
        let mut refs: Vec<Id> = self
            .references
            .iter()
            .filter(|r| {
                r.url
                    .as_str()
                    .starts_with("https://rustsec.org/advisories/")
            })
            .map(|r| Id::from_str(&r.url.as_str()[31..48]).expect("Invalid rustsec url"))
            .collect();
        refs.sort();
        refs.dedup();
        refs
    }

It seems that the prefix "https://rustsec.org/advisories/" is 31 bytes.
The slice [31..48] assumes 17 more bytes for the following (the length of RUSTSEC-YYYY-NNNN) ?
URLs that match the prefix but are shorter than 48 bytes cause an out-of-bounds panic.
Also, URLs that are long enough but don't contain a valid advisory ID cause a panic from expect.

Reproduce

Create a reference URL that starts with https://rustsec.org/advisories/ but is shorter than 48 bytes, then call rustsec_refs_imported()

Start in rustsec/src/osv/advisory.rs at rustsec_refs_imported() and inspect how advisory reference URLs are parsed. Reproduce the short and malformed rustsec.org URL cases described in the issue, then run the project's tests. Done means these inputs no longer panic while valid advisory references continue to produce IDs.