Make provider configurable for being listed or mirrored

[bernhardreiter]

The provider should be configurable for indicating that it wants to be

• listed
• mirrored

[s-l-teichmann]

The branch provider-listed-mirrorred implements this.

In the config there is a new optional table provider_metadata with
bool fields list_on_CSAF_aggregators and mirror_on_CSAF_aggregators
which are both are optional. If not set the defaults of the standard are used (true).

The publisher field of the config is moved into the provider_metadata table
as it is on the same level as list and mirror options in the generated provider_metadata.json
file.