[FEATURE]: EPSS Score on Vulnerability model #481

Describe the feature

Vulnerabilities can have an EPSS score attached to them. This describes the probability of a vulnerability being exploited. As of spec version 1.6, there is no clear way to attach this to a CycloneDX Vulnerability.

A vulnerability does have a slot for ratings, but it is not clear whether it can be used to include the EPSS, which consists of two values (the probability score itself, a percentile). It might be worth introducing a new slot for this vulnerability attribute.

Possible solutions

Shooting from the hip.

type Vulnerability {
  bom-ref string
  // ...
  epss    EpssScore
}

type EpssScore {
  probability float
  percentile  float
}

Alternatives

Getting it into the ratings, but it does not really fit the "severity" category that ratings was intended for.

Additional context

Support for EPSS was added to SPDX 3.0: https://spdx.github.io/spdx-spec/v3.0/model/Security/Classes/EpssVulnAssessmentRelationship/