fix(vulnerability): use VendorSeverity fallback before returning UNKNOWN

When neither the data source nor NVD have a severity entry,
iterate VendorSeverity in AllSourceIDs priority order to find
any available source. This ensures SeveritySource is set whenever
vendor data is available, instead of silently returning severity
from the top-level Severity field with an empty SeveritySource.

Author: DmitriyLewen

pkg/vulnerability/vulnerability.go

@@ -162,12 +162,16 @@ func (c Client) autoDetectSeverity(vulnID string, vuln *dbTypes.Vulnerability, d
 		return severity, severitySource
 	}
 
-	if vuln.Severity == "" {
-		return dbTypes.SeverityUnknown.String(), ""
+	// Fall back to any available VendorSeverity source in AllSourceIDs priority order.
+	// This handles cases where neither the data source nor NVD have a severity entry.
+	for _, source := range vulnerability.AllSourceIDs {
+		if severity, ok := vuln.VendorSeverity[source]; ok {
+			onceWarn()
+			return severity.String(), source
+		}
 	}
 
-	onceWarn()
-	return vuln.Severity, ""
+	return dbTypes.SeverityUnknown.String(), ""
 }
 
 func (c Client) getPrimaryURL(vulnID string, refs []string, source dbTypes.SourceID) string {