Support for correction db

[prabhu]

dep-scan use a rudimentary vendor and package name alias to fix misfiled CVEs. However, some CVEs are terribly filed with no version number information and even missing CPEs. We need to think about a way to add the corrections data to dep-scan and make it scalable.