fix(website): display severity source

[ZedingZhang]

Overview

Display the optional severity source on vulnerability detail pages so users can distinguish NVD, CNA, and self-attributed assessments.

Fixes #5922

Details

• Preserve severity source when building the Go website display model.
• Render the source in both the Go and legacy Jinja vulnerability templates when present.
• Add an emulator fixture containing a CVSS severity attributed to NVD.
• Add regression coverage for source propagation while leaving source-less records unchanged.

Testing

• go test ./internal/website
• go vet ./internal/website
• pnpm --dir gcp/website/frontend3 exec webpack --config webpack.dev.js --mode development
• Validated the updated fixture against osv/osv-schema/validation/schema.json.
• Parsed the Jinja template with Jinja2.

This contribution was created with AI assistance (OpenAI Codex); the changes and test results were reviewed before submission.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.