feat(vulnfeeds): handle rejected CVEs and propagate withdrawn status

[jess-lowe]

If a CVE is marked as Rejected upstream (in NVD or CVEList), OSV will now handle it properly instead of ignoring the change or keeping stale data.

How it works

• If we already had the record in cve5 or nvd OSV records, it gets updated with a "Withdrawn" timestamp.
• If a rejected CVE is brand new to us, we make a tombstone record so it gets withdrawn properly.
• In the final step (combine-to-osv), if either source is rejected, the combined OSV file is deleted to keep the feed clean.
• We skip merging logic in combine-to-osv if we know a record is withdrawn.

(Tested and verified with local scripts and unit tests).

Closes #4610

[another-rex]

If a rejected CVE is brand new to us, we ignore it.

Should we also just be publishing withdrawn entires for them rather than ignoring it?
At least, should we be doing this in the cve and nvd versions, and then in combine-to-osv decide whether to publish it. (To avoid cases where it's withdrawn in nvd, but there in cve, and we're just publishing it as if cve is the only source and not correctly marking it as withdrawn.)