fix(migration): re-derive base_score from advisory_vulnerability_score

[ctron]

Summary

• Fix migration m0002270 that re-derives vulnerability.base_score, base_severity, and base_type from advisory_vulnerability_score
• Fixes two issues discovered while investigating TC-5272:
  1. NULL base_score ("Unknown" in UI): CVEs ingested on 0.2.x before base_score columns existed were never backfilled after upgrading
  2. Wrong base_type: Migration m0002170 hardcoded base_type = '3.0' for all existing scores, even v4.0 and v2.0 ones
• Refactors CVE score extraction to use a single code path (removes duplicate extract_base_score/get_score logic)
• Fixes score computation when CVE JSON only contains vectorString without individual metric fields

Workaround

To fix existing data without deploying, run this SQL directly on the database:

UPDATE vulnerability
SET base_score = best.score,
    base_severity = best.severity,
    base_type = best.type
FROM (
    SELECT DISTINCT ON (avs.vulnerability_id)
           avs.vulnerability_id,
           round(avs.score::numeric, 1) AS score,
           avs.severity,
           avs.type
    FROM advisory_vulnerability_score avs
    JOIN vulnerability v ON v.id = avs.vulnerability_id
    WHERE v.authoritative_advisory_id IS NOT NULL
      AND avs.advisory_id = v.authoritative_advisory_id
    ORDER BY avs.vulnerability_id, avs.type DESC, avs.score DESC
) best
WHERE best.vulnerability_id = vulnerability.id;

Note: This only works if the data migration m0002010_add_advisory_scores has been run and advisory_vulnerability_score is populated. If that table is empty, the data migration must be run first (trustd db data m0002010_add_advisory_scores).

Test plan

• cvss_v4_score_visibility — verifies all endpoints return correct scores after fresh ingestion
• cvss_v4_score_after_cve_history — verifies re-ingestion of all 6 historical revisions preserves correct scores
• cvss_v4_score_after_migration::from_02z — reproduces TC-5272: CVE ingested on 0.2.x → NULL base_score after migration → fix migration backfills it
• cvss_v4_score_after_migration::from_03z — CVE ingested on 0.3.z → wrong base_type after migration → fix migration corrects it
• cvss_v4_score_after_migration::from_04z — CVE ingested on 0.4.z → wrong base_type after migration → fix migration corrects it
• base_score_after_ingestion — existing parameterized test with new CVSS v4.0 case, all pass
• Full workspace test suite passes

Implements TC-5272

🤖 Generated with Claude Code

[sourcery-ai]

Sorry @ctron, your pull request is larger than the review limit of 150000 diff characters

[codecov]

Codecov Report

❌ Patch coverage is 94.11765% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 72.20%. Comparing base (e47dacf) to head (5126d25).

Files with missing lines	Patch %	Lines
...es/fundamental/src/vulnerability/endpoints/test.rs	91.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2536      +/-   ##
==========================================
+ Coverage   72.17%   72.20%   +0.03%     
==========================================
  Files         465      466       +1     
  Lines       28702    28719      +17     
  Branches    28702    28719      +17     
==========================================
+ Hits        20715    20736      +21     
+ Misses       6812     6802      -10     
- Partials     1175     1181       +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.