Shadowserver: Use severity field

[sebix]

Currently, the Shadowserver schema utilizes the extra.severity field for severity data.

IntelMQ 3.5.0 introduced the new top-level field severity.

The shadowserver schema should use the new field instead.

On the mailing list I have posted a workaround: https://lists.cert.at/mailman3/hyperkitty/list/intelmq-users@lists.cert.at/thread/YSTGR6UHVXZ7Q4REWJDGXZHWRJD3VDYU/

cc @aaronkaplan @kamil-certat

[aaronkaplan]

Question: apart from shadowserver, is any other parser or expert using the "extra.severity" field? Let's check.

[elsif2]

With the updated schema previous releases should fall back to using "extra.severity". I just need to do some testing to confirm that is true.

[sebix]

Off-Topic:

Question: apart from shadowserver, is any other parser or expert using the "extra.severity" field? Let's check.

The only other that I know of (grepping the code) is Microsoft CTIP. See https://helenus.cert.at/mailman3/hyperkitty/list/intelmq-dev@lists.cert.at/message/TJJCHFOMURSOUI73JCSZELKTFERDRWCB/

[elsif2]

With the updated schema previous releases should fall back to using "extra.severity". I just need to do some testing to confirm that is true.

Confirmed.

Updated schema for review: #2670 (comment)