schema: Move the `severity` from `Vulnerability` into the respective `Affected`

[fviernau]

Vulnerability has the arrays severity and affected. I couldn't find the documentation for these arrays, but my guess is that the i-th severity entry corresponds to the package referenced by the i-th entry in affected.

Can you confirm that above assumption is true? If so, would it make sense to change the schema as follows?

from:

Vulernability (
  ...  
  severity[]
  affected[]
  ...
)

to:

Vulernability (
  ...  
  affected[]
  ...
)

Affected(
  ...
  severity
  ...
)

[oliverchang]

Hi!

This assumption is not correct -- the severity field is an array only to account for multiple scoring algorithms (currently only CVSS is supported).

I think we need some clarification on the spec (https://ossf.github.io/osv-schema/#severity-field) here?

[another-rex]

Close since moved over to osv-schema