fix(suse): use CVSSScoreSets as array

[DmitriyLewen]

Description

This PR fixes the CVSSScoreSets field type in the SUSE CVRF parser. The field was incorrectly defined as a single ScoreSet struct when it should be a slice []ScoreSet, as CVRF documents can contain multiple CVSS score sets per
vulnerability.

Note:

This PR should only be merged after aquasecurity/vuln-list-update#401 is merged, as both PRs implement the same fix on different sides (vuln-list-update generates the data, trivy-db consumes it).

Changes

• Changed CVSSScoreSets field type from ScoreSet to []ScoreSet in pkg/vulnsrc/suse-cvrf/types.go
• Updated test data files to reflect the correct JSON structure:
  • Removed empty CVSSScoreSets: {} objects (which were artifacts of the incorrect single-struct type)
  • Added a test case with populated CVSS scores as an array in openSUSE-SU-2019-2598-1.json

Related PRs

Blocker:

• fix(suse): save CVSSScoreSets as array vuln-list-update#401 — the corresponding fix in vuln-list-update that changes JSON serialization to use an array