combine-to-osv: withdraw rejected CVEs

[andrewpollock]

Describe the bug
While creating #2146 (off the back of #2129) it occurred to me that combine-to-osv doesn't mark rejected CVEs as withdrawn when converting them to OSV records, and I think they should be.

Expected behaviour
Rejected CVEs expressed as OSV records should be marked as withdrawn.

Screenshots
https://api.osv.dev/v1/vulns/CVE-2024-31745 is the example.

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

[Thakor-Yashpal]

"Can I work on resolving this issue?"

[andrewpollock]

@Thakor-Yashpal sure!

[andrewpollock]

Implementation thought:

in

osv.dev/vulnfeeds/vulns/vulns.go

Lines 614 to 628 in cf067d4

	func FromCVE(id cves.CVEID, cve cves.CVE) (*Vulnerability, []string) {
	aliases, related := extractReferencedVulns(id, cve)
	v := Vulnerability{
	ID: string(id),
	Details: cves.EnglishDescription(cve),
	Aliases: aliases,
	Related: related,
	}
	var notes []string
	v.Published = cve.Published.Format(time.RFC3339)
	v.Modified = cve.LastModified.Format(time.RFC3339)
	v.References = ClassifyReferences(cve.References)
	v.AddSeverity(cve.Metrics)
	return &v, notes
	}

simply test for cve.VulnStatus == "REJECTED" and set v.Withdrawn to v.Modified if true...

[Vedthakar]

Since its been a months can I look into this?