feat: rework combine-to-osv to begin to combine NVD and CVE5 OSV records

[jess-lowe]

NVD Output Changes:

• Updates the NVD conversion to start outputting OSV records instead of PackageInfo
• Changes the output location of NVD to no longer be in the 'parts' directory

combine-to-osv changes:

• reads in two file paths for NVD OSV data and CVE5 OSV data
• lists CVEIDs of Alpine and debian vulns and generates the 'upstream' records for them too so they still have an upstream,
• somewhat intelligently tries to combine data between the records, with a bias toward the CVE5 conversion.
• outputs the files.

[another-rex]

Same concern here as above, is this the correct assumption? What if cve5 has different ranges?

[jess-lowe]

I'm going to look at improving and handling this in a future PR. For now, I just want to have some level of merging intelligence, so we can start populating the records, and will work on improving it later.

[another-rex]

Nice!

[another-rex]

LGTM!