Rewrite NVD provider

[wagoodman]

The existing NVD provider has a few issues:

• the existing "data-feeds" source is deprecated and will be removed within 9 months https://nvd.nist.gov/vuln/data-feeds
• the existing provider requires refactors to remove unnecessary CPE version expansion
• the existing provider takes 20 minutes to run even when all data is cached

The new implementation:

• uses the new V2 JSON API (https://nvd.nist.gov/developers/vulnerabilities)
• does minimal (no) transforms on the incoming data
• supports incremental updates up to 120 days of drift (longer periods cannot be implements due to a NIST API limitation)

Closes #11
Closes #9