Revisit advisory aggregate severity

Per ADR https://github.com/trustification/trustify/pull/1604 an aggregate severity is concept defined only in CSAF files. Currently we calculate it as an average of severities found in the advisory. We should change this behaviour and populate the field only for csaf advisories. In the first discussions we gave up on defining a custom metric here, but that can be revisited in the future.