Map NVD severities to Alpine vulnerabilities

[maciejd-mh]

Hi

Clair integration in Quay.io is great but I miss severity information for Alpine vulnerabilities.
Alpine's secdb does not include severity but it would be useful to use something like NVD (or the GHSA/OSV feeds) as fallback or an alternative.

I know Trivy defaults to pulling severity from NVD for Alpine.