fix(cpe): fix cpe match false positive

[kotakanbe]

Also check vendor, product while matcing.

ex:
in the current implementation, cpe:/a:apache:struts:2.3.35 detects below CVEs.
https://nvd.nist.gov/vuln/detail/CVE-2016-3093

Vulnerable software and versions Switch to CPE 2.2
Configuration 1
AND
OR
 cpe:2.3:a:ognl_project:ognl:*:*:*:*:*:*:*:*    versions up to (including) 3.0.11
OR
 cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*
 cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*
 cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*
....

It will be detected incorrectly by matching a:ognl_project:ognl.

https://nvd.nist.gov/vuln/detail/CVE-2013-4316