Improve vulnerability ranking and scoring

[pombredanne]

@pombredanne just FYI might be relevant Stephen Shaffer "Modeling Asset Risk Using Grouped EPSS" https://www.youtube.com/watch?v=W2UMqkRyBOY. He and I will be adding a chapter on this to the RBP guide https://riskbasedprioritization.github.io/

Originally posted by @Crashedmind in #102