#1628: Support for OS specific CVEs

[laert-ll]

This PR fixes #1628

Implemented changes:

security.json CVE model extended so that a single CVE can express affected version ranges that only apply on specific operating systems.

• Added an optional conditions map to the Cve model.
• CveJsonDeserializer / CveJsonSerializer read and write conditions. It is only written when present, so existing security.json files remain unchanged.
• Cve.isAffected(version, os) combines the global versions with the current OS's conditional ranges; Cve.merge(...) also merges the per-OS conditions.
• Added CHANGELOG entry.

---

Testing instructions

Run mvn clean test

Manual (single machine):

1. For a tool you can install, edit <IDE_ROOT>/urls/<tool>/<edition>/security.json (create if absent) and add a CVE whose global versions do NOT match the version you'll install, but whose conditions for your current OS (windows/linux/mac) do:

   { "issues": [ { "id": "CVE-TEST-OS", "severity": 9.0,
     "versions": ["(0,0.0.1)"], "conditions": { "linux": ["[<version>]"] } } ] }

2. Set _VERSION= in ide.properties and run ide install CVE-TEST-OS is reported (matched only via the OS condition).
3. Change the key to a different OS and re-run the CVE is no longer reported.

---

Checklist for this PR

Make sure everything is checked before merging this PR. For further info please also see
our DoD.

• When running mvn clean test locally all tests pass and build is successful
• PR title is of the form #«issue-id»: «brief summary» (e.g. #921: fixed setup.bat and not feature/921 fixed setup.bat). If no issue ID exists, title only.
• PR top-level comment summaries what has been done and contains link to addressed issue(s)
• PR and issue(s) have suitable labels
• Issue is set to In Progress and assigned to you or there is no issue (might happen for very small PRs)
• You followed all coding conventions
• You have added the issue implemented by your PR in CHANGELOG.adoc unless issue is labelled
  with internal
• You have not changed any dependency in pom.xml files or otherwise if runtime dependencies changed, you have updated our LICENSE.asciidoc
• You have formulated clear instructions on how to test your contribution under "Testing instructions"

[coveralls]

Coverage Report for CI Build 33875481856

Coverage increased (+0.02%) to 73.824%

Details

• Coverage increased (+0.02%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• 48 coverage regressions across 4 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

48 previously-covered lines in 4 files lost coverage.

File	Lines Losing Coverage	Coverage
com/devonfw/tools/ide/tool/ToolCommandlet.java	35	76.1%
com/devonfw/tools/ide/url/model/file/json/Cve.java	11	81.72%
com/devonfw/tools/ide/url/model/file/json/CveJsonDeserializer.java	1	94.29%
com/devonfw/tools/ide/version/VersionSegment.java	1	89.5%

---

Coverage Stats

Relevant Lines:	18626
Covered Lines:	14368
Line Coverage:	77.14%
Relevant Branches:	8299
Covered Branches:	5509
Branch Coverage:	66.38%
Branches in Coverage %:	Yes
Coverage Strength:	3.29 hits per line

---

💛 - Coveralls

[Ali-Shariati-Najafabadi]

Pulled the branch and ran the full test suite locally plus checkstyle. Build is green and the core idea (isAffected/merge/JSON round-trip) works and is tested. Found one actual crash bug and a few smaller things worth looking at before merging, left inline.

[hohwille]

@laert-ll thanks for your PR. Great work, well done 👍
I actually had to read my own story again to do the review properly.
Only then I remembered why we had to do this so complicated instead of just having an os property with an array of OSes that the CVE applies to. But in reality a CVE can apply versions for all OS but other versions only for particular OS. With this more complex design we can represent all the states we need to express the reality that actually is complex.

I left some review comments which are all small constructive suggestions to make the code cleaner or nicer but nothing I found was wrong in any way.
IMHO we can apply all suggestions and then merge this PR.
Great that you already fixed the merge method so completing the story to also use this new feature in the security updater process is now very easy.

p.s.: You could have passed the SystemInfo instead of just OperatingSystem since then we do not have to refactor anything in the future if we might also need to support CVE versions that are even specific to the combination of OS + architecture. But since this is not needed for now, we can leave that as is and refactor only in case we ever run into such demand.