Add Eclipse Foundation security advisories importer

[NucleiAv]

Closes #1495

HTML parsing the Eclipse website at https://www.eclipse.org/security/known.php would return nothing useful because the CVE-ID links in the table redirect to NVD and the project links return a 404. Instead I found that the website renders its advisory table entirely via JavaScript from a JSON API endpoint. By inspecting the JS bundle, I found https://api.eclipse.org/cve which returns all 197 advisories as a clean JSON array with no auth and no pagination required. So I choose API approach, since its clean and consistent.

Each entry provides details like CVE ID, publish date, Eclipse project name, summary, CVSS score, and reference URLs (CVE Mitre link, Eclipse bugtracker ticket, GitHub CVE pull request where applicable).

API does not provide CVSS vector string or version (only a bare float score, stored using GENERIC scoring system), CWE weaknesses, and affected or fixed package versions. These fields are left empty.

[ziadhany]

@NucleiAv Good start, see some comments there.

[ziadhany]

I think something like this is simpler.

Suggested change

	summary_obj = entry.get("summary")
	summary = summary_obj.get("content") or "" if isinstance(summary_obj, dict) else ""
	summary_obj = entry.get("summary", {})
	summary = summary_obj.get("content") or ""

[NucleiAv]

Used entry.get("summary") or {} instead of the suggested entry.get("summary", {}) because the API actually returns "summary": null for some entries (CVE-2024-2212 in the sample data). When the key exists but its value is null, .get("summary", {}) still returns None, which makes None.get("content") blow up. The or {} handles both the missing key and the null case cleanly.

[ziadhany]

Suggested change

	if cvss is not None:
	if cvss:

[NucleiAv]

Done!

[ziadhany]

Do we have any examples of this? If yes, please log this, if no, please remove it.

Suggested change

	if not advisory_id:
	return None

[NucleiAv]

I removed it since I did not find any instances in API data

[ziadhany]

Please change this to test against the file instead of running parse_advisory for every attribute.

[NucleiAv]

Replaced the whole class with a single test_parse_advisories() that runs all three sample entries and checks against an expected JSON file using util_tests.check_results_against_json. Also dropped test_collect_advisories_skips_on_http_error as it had assert not hasattr(...) or True which is always true and wasn't actually testing anything.