Add CVE or vulnerability ID requirement to Security Advisory

[tschmidtb51]

As discussed during the TC meeting on 2026-08-26, the profile Security Advisory is extended by the following requirement:

  - at least one of
    - `$.vulnerabilities[*].cve`
    - `$.vulnerabilities[*].ids`

[tschmidtb51]

2026-08-26 TC meeting: Thomas Schmidt moved to accept it in CSAF 2.1, Justin seconded, no objection, no discussion, unambiguous consent. Motion carried

[tschmidtb51]

Todo:

• adapt prose
• tests
• adapt conversion rule
• add to clause 6: option to assign vuln id or CVE id