Support CMSS as a severity type

[G-Rath]

CMSS is used by the Drupal ecosystem which we've recently created a database for.

My understanding is that there is some overlap with CVSS meaning it could be theoretically possible to convert a CMSS rating to a CVSS, but overall it would be better if we could just use CMSS as a severity type in our advisories

[zmanion]

Sigh ;)

First, I'm mostly just here to comment about CMSS, I have no strong position on CMSS support for OSV.

Props to Drupal for using the CMSS (CVSS, CCSS) vectors but not the complicated and illegal math. But -1 for still using illegal math, can you really add "Authentication:User" to "Integrity impact:Some"? If the heuristic is working for Drupal and users, great, and ignore my complaining.

My possibly incorrect understanding of OSV is that Drupal would need a new ecosystem type, not just Drupal-modified-CMSS support? Or maybe there's a way to use Drupal-modified-CMSS for Drupal vulnerabilities added from the NVD/CVE converter or from other ecosystems that package Drupal?

[G-Rath]

@zmanion thanks for the feedback - this issue is just about adding vanilla CMSS as a valid severity type to the spec, which would allow us to enrich our OSV advisories, not a representation of everything that is needed for Drupal to be correctly represented by the OSV specification and ingested into osv.dev (and really this change is actually optional to that since having severity information isn't a requirement)

From my preliminary discussions with the team, the prefix id and ecosystem are the main blocker to decide on which I'll be opening a dedicated issue for hopefully soon once I've had a chance to discuss more with the Drupal community