Enrichment and fix-first scoring

[martian56]

Pull external feeds and turn raw advisories into a fix-first ranking.

• Ingest EPSS, CISA KEV, and OSV on a schedule
• Compute priority from CVSS, EPSS, KEV, and reachability
• Re-score affected findings when a feed updates, without re-hitting GitHub