Add severity for vulnerabilities

[lizrice]

Currently the severity is mapped from the category. Severity should relate to the specific vulnerability / exposure.

[iyehuda]

Agreed.

I discussed with @itaysk about severity in the context of necessary refactor. The discussion essence it that apart of category mapping to severity, each and every event should declare its severity in its definition.

There is also needed change in how we treat Events/Vulnerabilities/Services since there is a possible overlap in their behavior which may be reasonable, but can mislead to wrong implementations.