refactor: cve5 conversion to be more modular and extensible per CNA

[jess-lowe]

This PR:

• Moves the cve5 conversion code out of the cmd folder
• creates a common.go folder for reused/common functions by the conversion
• initializes a factory-based design pattern for CNA based version extraction methods
  • Linux has its own extractor now
  • downside of this is that we may have to maintain multiple versions of the extractions, but we'll mitigate this by making sure code that is doing the same thing is abstracted into its own function.
• splits apart some of the version extraction patterns into their own functions.

[another-rex]

I think there's a conflict that needs to be resolved before we can review