Update NVD feed URL for CVSS data

[crozzy]

https://www.nist.gov/itl/nvd

NIST had previously started to transition from feed files (v1.1) and to a "RESTful" API (v2.0). These plans have now been nixed and they are going back to a feed file model. So in theory the updating paradigm for claircore should be unchanged but the response could be different (TBD when the new file feeds are published). Once the new feeds are published, the legacy (v1.1) feeds will be accessible for 3 months.

[daynewlee]

Is the schedule of 3 months tied to the number of Claircore release cycles?

[crozzy]

No, it the schedule comes from NIST:

Once these updates are made available, the unsupported legacy data feed files will remain available in parallel for 3 months as a courtesy