Better messages for JSON file problems: go's de-serialize versus jsonschema check

[bernhardreiter]

As seen in #408 we de-serialize JSON files into go structures before we check the JSON against a schema.

This is the case because v5 of our library for JSON Schema checks requires a de-serialized object.

Since https://pkg.go.dev/github.com/santhosh-tekuri/jsonschema/v6 a string can be checked with the Validate function as well.

Both will have the happen: de-serialization into our specialized CSAF go structures and the JSON schema test.

The question is: Should be change the order of checks? Which comes down to: Which message is more helpful to users?

We would need to check the v6 messages against the de-serialized messages and see which one is better. Also the effect on performance should be roughly estimated, as we expect the de-serialization first will fail earlier in the processing.

(split out from #408)

[bernhardreiter]

The highest relevance is for the checker, but if we change it there, we should do it consistently over the whole code base.