[Jaswanthmadimi]

Problem

format_data_api2 cleans CVSS_vector with re.sub("[^A-Za-z0-9:/]", "", ...).
That filter also removes ., so every NVD CVSS 3.x vector is stored without the
dot in its version prefix: CVSS:3.1/AV:N/... becomes CVSS:31/AV:N/..., and
CVSS:3.0/ becomes CVSS:30/. The cvss library rejects these vectors. OSV
vectors are stored with the dot (via CVSS3.clean_vector()), so today the two
sources store vectors in different forms. CVSS 2 vectors have no prefix and are
not affected.

Change

• Allow . in the filter. Everything else it removed is still removed.
• Update the comment above it, which lists the allowed characters.
• Add two tests that run format_data_api2 on a minimal NVD API 2.0 record:
  a CVSS:3.1/ vector is stored unchanged, and a vector surrounded by junk
  characters (space, quotes, ;<>, newline) is still cleaned without losing
  the dot.

Effect for users

After the next database update, NVD vectors in output that shows them (for
example CSV and JSON) read CVSS:3.1/... instead of CVSS:31/.... Scores and
severities don't change. Existing databases keep the old form until they are
refreshed.

Testing

• Both new tests fail on main, only because of the missing dot, and pass with
  this change.
• pytest test/test_source_nvd.py test/test_source_osv.py test/test_cvedb.py test/test_nvd_api.py test/test_fetch_json_db.py: 33 passed, 12 skipped
  (network/long tests). Before: 31 passed, 12 skipped; the difference is the 2
  new tests.
• pre-commit passed on the changed files.

This also matters for CVSS 4.0 support (#4238): with the current filter,
CVSS:4.0/ vectors would be stored as CVSS:40/. The same filter change is part
of #4944 by @JigyasuRajput; this PR splits it out as a standalone fix.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[ffontaine]

All tests passed, merge time