Ingest CVSS 4.0 metrics

We're currently only ingesting CVSS 3.1 data, but most new CVEs don't even ship that any more. This results in metrics not being shown in the overivew.

https://github.com/NixOS/nix-security-tracker/blob/8f4f5d745db7905b9a71de638595a62f9c8da35e/src/shared/fetchers.py#L102