fix: mark NVD records as disputed status based on cveTags

[pujitha24]

Motivation:
NVD API records can be labeled "disputed" via the cveTags field
(https://csrc.nist.gov/schema/nvd/api/2.0/cve_api_json_2.0.schema)
independently of the vulnStatus field. Grype's NVD unmarshaller never
captured cveTags, and the v6 transformer only derived vulnerability
handle status from vulnStatus, so these records ended up with an
incorrect status (e.g. unknown) instead of disputed. For example,
CVE-2001-1517 has vulnStatus "Deferred" (not a status grype maps to
anything) but cveTags contains a "disputed" tag, so its grype db
status should be disputed.

Approach:

• Add a CveTags field (and CveTag struct) to CveItem in
  grype/db/internal/provider/unmarshal/nvd/cve.go, matching the NVD
  API schema shape, plus an IsDisputed() helper that does a
  case-insensitive scan for a "disputed" tag.
• In grype/db/v6/build/transformers/nvd/transform.go, getVulnStatus
  now checks IsDisputed() before falling back to the vulnStatus-based
  switch, since a record can carry a disputed cveTag while vulnStatus
  is any other value (e.g. "Analyzed" or an unrecognized one like
  "Deferred"). This means a disputed tag takes precedence over any
  other vulnStatus mapping, including "rejected" - this is an
  intentional choice since disputed and rejected are independent,
  non-mutually-exclusive signals in the NVD data and disputed is the
  more actionable/specific one to surface.

Validation:
Ran go build ./... (passes) and go test ./grype/db/... (all
packages pass), including the new grype/db/v6/build/transformers/nvd
TestGetVulnStatus table test, which reproduces the exact scenario
from the issue (vulnStatus "Deferred" + a disputed cveTag ->
db.VulnerabilityDisputed), matching CVE-2001-1517's real NVD data.
Also fed the exact JSON payload from the issue through the updated
CveItem JSON decoding (in a local scratch test, not included in this
commit) and confirmed CveTags populates correctly and IsDisputed()
returns true.

This change affects the shared unmarshal/transform packages used to
build the grype v6 vulnerability database; it does not alter grype's
own scan-time behavior in this repo, only the derived status of
disputed NVD records once a database is rebuilt with this logic.

Report: #3248
Signed-off-by: Pujitha Paladugu 10557236+pujitha24@users.noreply.github.com

Fixes #3248

[pujitha24]

Just checking in on this — it'''s rebased and green, happy to make any changes that would help review go smoother.