feat(rules): Add CVSS 3.1/4 to high vulnerability

Prior to this change a package with a high severity vulnerability
encoded in CVSS 3.1 or 4.0 would not trigger a policy rule violation.

Signed-off-by: Thomas Steenbergen <[email protected]>

Author: tsteenbe

evaluator.rules.kts

@@ -1551,6 +1551,12 @@ fun RuleSet.vulnerabilityWithHighSeverityInDependencyRule() = packageRule("HIGH_
             },
             hasVulnerability(maxAcceptedSeverity, "CVSS:3") { value, threshold ->
                 value.toFloat() >= threshold.toFloat()
+            },
+            hasVulnerability(maxAcceptedSeverity, "CVSS:3.1") { value, threshold ->
+                value.toFloat() >= threshold.toFloat()
+            },
+            hasVulnerability(maxAcceptedSeverity, "CVSS:4.0") { value, threshold ->
+                value.toFloat() >= threshold.toFloat()
             }
         )
     }