Allow linkage to multiple vulnerability identifiers

[david-waltermire]

The vulnerability object needs a property that is used to identify it. This will typically be a CVE ID, but may be an identifier from another identification scheme.

1. A new object is needed that allows an identification scheme and identifier value to be provided.
2. A means to link to such an object is needed on the vulnerability, perhaps using a relationship (e.g. identifiedBy).
3. It may be desirable to allow linkage to multiple identifiers to allow multiple identification schemes to be used. The semantics of such a relationship needs to be clear. Do both identifiers identify the same vulnerability? Is there a difference in vulnerability scope that makes both not the same?

In the vulnerability object, the text starting with "An identifier" and ending with "many organizations" needs to be removed and transitioned to this new linkage. This will probably eliminate the need for "KnownChains".

[Chris-Turner-NIST]

New object created similar to the product object where an ID scheme and ID need to be supplied as properties.
Known chain serves a fundamentally different purpose than identified by and should link to this to allow for better semantic flexibility.

[Chris-Turner-NIST]

The semantics of such a relationship needs to be clear. Do both identifiers identify the same vulnerability? Is there a difference in vulnerability scope that makes both not the same?

Generally speaking, if multiple identifications schemes are used than the IDs supplies would still reference the same vulnerability. I'm not entirely sure how we could limit the scope of what is being identified as that would be controlled by the rules of the ID schemes themselves.

[Chris-Turner-NIST]

The current design of Vulnerability Identifier Object allows for multiple "identifiedBy" relationships to the vulnerability. In the event a vulnerability is identified by multiple systems and those systems can be defined within the properties of the vulnerability identifier we can inherently create a relationship of hasAlias between the two identifiers. This should suffice as mapping a vulnerability across different identification schemes