Add RSEC as a supported database prefix

[tylfin]

I want to get RSEC added to the list of supported database prefixes. This would cover the R language and packages hosted in cran.r-project.org or bioconductor.org package repositories.

I've started a repository here: https://github.com/RConsortium/r-advisory-database that can be used as a community-owned destination for these vulnerabilities.

I have an example of a vulnerability here: RConsortium/r-advisory-database#1 that shows what these will look like moving forward, and this repository generally follows the format of the PyPA's advisory database.

[david-a-wheeler]

+1.

R is used by many, and in particular is often used for statistical analysis of vast amounts of data... so vulnerabilities in certain R packages could have a serious impact.

[oliverchang]

Absolutely! Would be awesome to get RSEC included here. Can you please open a PR similar to #157 ?

[tylfin]

@oliverchang After #176 is approved and merged, what additional work is required to get RSEC vulnerabilities populating on https://osv.dev/? Happy to do whatever follow-up is necessary to start getting visibility on these

[oliverchang]

@tylfin I've filed google/osv.dev#1476 to track the work required on osv.dev side.

Just eyeballing the entries at https://github.com/RConsortium/r-advisory-database/blob/main/vulns/readxl/RSEC-2023-1.yaml, the timestamps look a bit problematic:

modified: "2023-07-13T14:37:06.6NZ"

I'm not sure we support the "N" suffix here (and it doesn't seem to be part of RFC 3339).

It would be worth converting these entries to JSON and then seeing if they validate against https://github.com/ossf/osv-schema/blob/main/validation/schema.json

[tylfin]

Should be all set, I added a GHA CI Check to ensure the repository adheres to the schema moving forward

[oliverchang]

@tylfin could I please also ask you to update https://github.com/ossf/osv-schema/blob/main/docs/schema.md#r-cran--bioconductor-vulnerability now that there are example entries in the DB?