#1628: Support for OS specific CVEs

[laert-ll]

This PR fixes #1628

Implemented changes:

security.json CVE model extended so that a single CVE can express affected version ranges that only apply on specific operating systems.

• Added an optional conditions map to the Cve model.
• CveJsonDeserializer / CveJsonSerializer read and write conditions. It is only written when present, so existing security.json files remain unchanged.
• Cve.isAffected(version, os) combines the global versions with the current OS's conditional ranges; Cve.merge(...) also merges the per-OS conditions.
• Added CHANGELOG entry.

---

Testing instructions

Run mvn clean test

Manual (single machine):

1. For a tool you can install, edit <IDE_ROOT>/urls/<tool>/<edition>/security.json (create if absent) and add a CVE whose global versions do NOT match the version you'll install, but whose conditions for your current OS (windows/linux/mac) do:

   { "issues": [ { "id": "CVE-TEST-OS", "severity": 9.0,
     "versions": ["(0,0.0.1)"], "conditions": { "linux": ["[<version>]"] } } ] }

2. Set _VERSION= in ide.properties and run ide install CVE-TEST-OS is reported (matched only via the OS condition).
3. Change the key to a different OS and re-run the CVE is no longer reported.

---

Checklist for this PR

Make sure everything is checked before merging this PR. For further info please also see
our DoD.

• When running mvn clean test locally all tests pass and build is successful
• PR title is of the form #«issue-id»: «brief summary» (e.g. #921: fixed setup.bat and not feature/921 fixed setup.bat). If no issue ID exists, title only.
• PR top-level comment summaries what has been done and contains link to addressed issue(s)
• PR and issue(s) have suitable labels
• Issue is set to In Progress and assigned to you or there is no issue (might happen for very small PRs)
• You followed all coding conventions
• You have added the issue implemented by your PR in CHANGELOG.adoc unless issue is labelled
  with internal
• You have not changed any dependency in pom.xml files or otherwise if runtime dependencies changed, you have updated our LICENSE.asciidoc
• You have formulated clear instructions on how to test your contribution under "Testing instructions"

[coveralls]

Coverage Report for CI Build 33053632967

Coverage increased (+0.04%) to 73.766%

Details

• Coverage increased (+0.04%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• 47 coverage regressions across 3 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

47 previously-covered lines in 3 files lost coverage.

File	Lines Losing Coverage	Coverage
com/devonfw/tools/ide/tool/ToolCommandlet.java	35	76.1%
com/devonfw/tools/ide/url/model/file/json/Cve.java	11	81.05%
com/devonfw/tools/ide/url/model/file/json/CveJsonDeserializer.java	1	94.29%

---

Coverage Stats

Relevant Lines:	18264
Covered Lines:	14074
Line Coverage:	77.06%
Relevant Branches:	8099
Covered Branches:	5373
Branch Coverage:	66.34%
Branches in Coverage %:	Yes
Coverage Strength:	3.29 hits per line

---

💛 - Coveralls