Add CVSS-based (v1, v2, v3) decision points as python classes

[ahouseholder]

Depends on

• Add new json schemas for decision points and dp groups #340
• Add SSVC python module #342

Adds Decision Point and Decision Point Group models for CVSS v1, v2, and v3 vectors.

Includes unit tests to validate output against json schema from #340.

• Resolves Model CVSS v1, v2, v3 vector elements as decision points #330

[ahouseholder]

Note: everything new in this PR that is not already in #342 is in commit 8f2bc07

[j---]

I'm flagging some things here but the general question is about how we are applying SSVC decision point versioning.

If we accept any CVSS metric name change as a new object, we are essentially assuming that CVSS only changes names when the major/minor/patch version rules introduced in #350 don't apply. I do not believe that's the case, I think CVSS has changed metric names for messaging reasons. These are valid reasons, but they differ from our agreed SSVC decision point versioning rules. If we are properly integrating CVSS metrics as SSVC decision points, I suggest we apply our own versioning rules (which I think means we do not treat a metric name change as automatically a new object).

If this reasoning holds, AV and AC are the only ones it applies to here. It will come up again from v3 to v4.