ROX-34928: Wire CISA KEV exploit data through converters

[ajheflin]

Description

Wire CISA KEV exploit data from Scanner V4 through Central's converter layers. PR 2/3 in a stack.

• Add exploit() converter function in pkg/scanners/scannerv4/convert.go (maps CISAExploit → storage.Exploit, intentionally omits catalog_version)
• Add cisaKevExploit()/cisaKevEnabled() feature-flag-gated helpers
• Wire into buildEmbeddedVulnerability() and mergeScoringFields()
• Propagate exploit field in central/cve/converter/utils/ (both v1 and v2 converter paths)
• Add unit tests for the exploit converter and update existing round-trip tests

Follows the EPSS pattern exactly. Gated behind ROX_CISA_KEV feature flag.

Stack: [Proto changes] → 2/3 — Converter wiring → [Reporting + GraphQL]

Depends on: #21750

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• modified existing tests

How I validated my change

• TestExploit — 3 cases: full data, known ransomware, nil input
• TestImageCVEV2ToEmbeddedCVEs / TestEmbeddedCVEToImageCVEV2 — updated round-trip tests with exploit data
• All tests pass: go test ./pkg/scanners/scannerv4/ ./central/cve/converter/utils/ -count=1

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

🚀 Build Images Ready

Images are ready for commit 11d5bc8. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.12.x-495-g11d5bc8b4f

[github-actions]

🚀 Build Images Ready

Images are ready for commit 11d5bc8. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.12.x-495-g11d5bc8b4f

[ajheflin]

This change is part of the following stack:

• ROX-34928: Add Exploit proto message for CISA KEV support #21750
  • ROX-34928: Wire CISA KEV exploit data through converters #21751 ◀
    • ROX-34928: Add CISA KEV to reports and GraphQL #21752

_{Change managed by git-spice.}