Fix querying by commit integration test more

[andrewpollock]

The additional matching CVE has now been rejected, and the text of the description has changed. I suspect we haven't seen the last of this yet, as a rejected CVE should be resulting in a withdrawn OSV record...

(I'm investigating why that isn't the case, but want to unbreak the test)

[andrewpollock]

I confused disputed CVEs with rejected ones.

osv.dev/vulnfeeds/cmd/combine-to-osv/main.go

Lines 119 to 128 in aad1acb

	if len(cveList) > 0 {
	// Best-effort attempt to mark a disputed CVE as withdrawn.
	modified, err := vulns.CVEIsDisputed(convertedCve, cveList)
	if err != nil {
	Logger.Warnf("Unable to determine CVE dispute status of %s: %v", convertedCve.ID, err)
	}
	if err == nil && modified != "" {
	convertedCve.Withdrawn = modified
	}
	}

withdraws disputed CVEs.

I think we also need to be reflecting rejected ones as withdrawn. I'll file an issue for this.