Group using related field for specific ecosystems

[another-rex]

Some ecosystems like Debian use related field to specify that a DSA covers multiple CVEs. This is placed in related instead of aliases because this relation is not necessarily reflexive (i.e. a DSA covers N CVEs, but each CVE don't fully cover a DSA), but normal aliases are reflexive.

For the purposes of grouping, we should group DSA related and the CVEs it covers to avoid showing overlapping vulnerability results.

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

See https://github.com/google/osv-scanner/blob/main/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.

[oliverchang]

ossf/osv-schema#312 adds upstream to the schema, which should be used for this case once it's adopted.