Add test: Consistent PIH

[tschmidtb51]

We have seen CSAF documents that have product_identification_helper that do not match the product described in branches, e.g. the version number is missing in a CPE or purl. We should add a mandatory (?) test to check for the low-hanging fruits.

[santosomar]

During the CSAF TC Monthly meeting on 2024-11-27, Feng provided the update of the CVE efforts around CPE assignments and the reference to: https://csrc.nist.gov/schema/nvd/feed/1.1/nvd_cve_feed_json_1.1.schema

[santosomar]

Thomas Schmidt moves to adopt the implementation of a mandatory test within the CSAF validation process to identify and flag discrepancies between the product_identification_helper and the product details specified in the branches section of CSAF documents. This test will focus on low-hanging issues, such as missing version numbers in Common Platform Enumeration (CPE) identifiers or Package URLs (purls). The motion was seconded by Sonny. The motion passed.