Add artifactID/artifactType to product in affected array

[alilleybrinker]

The affected array is an array containing product objects, which must at minimum include an "identifier" (which may be a composite identifier composed of multiple fields) along with a set of version bounds or a default status. Products may also specify an assortment of additional fields which further constrain the applicability of the CVE to its intended target hardware or software.

Previously, the set of identifiers available were:

• A vendor and product
• A collectionURL and packageName

This commit adds support for a new pair of fields to support using OmniBOR Artifact IDs as identifiers in the affected array:

• artifactID: The OmniBOR Artifact ID for an artifact.
• artifactType: An enum indicating whether the artifactID is for an artifact to search in a file system for, or whether it's a build input to search against OmniBOR Input Manifests.

The commit also adds data constraints to ensure this new identifier pair is not used alongside fields that don't make sense to use with OmniBOR, including the other identifier schemes, further decomposition information like programFiles or programRoutines, and version information.

This work is submitted as an alternative formulation of the design proposed in the draft RFD on software identifiers 1, and as an alternative to the existing proposals for making the cpeApplicability structure generic 2 (instead of it being CPE-specific) and enhancing this new generic applicability structure with support for OmniBOR Artifact IDs 3.

If this change is accepted, then 2 and 3 should not be accepted.

[alilleybrinker]

(This really applies to the RFD #407, but I am pasting it here as well for completeness)

Note

Final Comment Period

A Final Comment Period (FCP) has been called for this proposal. This is a final opportunity to raise new concerns with the proposal.

The FCP will close at 2pm PDT / 5pm EDT July 3rd, at the end of the Quality Working Group Meeting.